CVE-2016-6328

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-31 · updated 2026-06-17
Weakness: CWE-190

Description

A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.10
Debian Linux: 8.0
libexif project libexif: before 0.6.22 — fixed in 0.6.22

How to fix

Upgrade to a fixed version: libexif project libexif 0.6.22. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6328
https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html
https://security.gentoo.org/glsa/202007-05
https://usn.ubuntu.com/4277-1/
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6328
https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html
https://security.gentoo.org/glsa/202007-05
https://usn.ubuntu.com/4277-1/

Get alerted when CVE-2016-6328 or the next vulnerability affects your stack