High
Security advisory
An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-13113
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:03 UTC · Revision 1
Source evidence
An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.
osv:CVE-2020-13113
Complete source record
{
"id": "28d32c8d9990034b68cee9d1318c5a8a4b5e9ca299b6eabfa13b9bb3a688c6d2",
"url": "https://osv.dev/vulnerability/CVE-2020-13113",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-13113",
"summary": "An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.",
"evidence": "osv:CVE-2020-13113",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-13113",
"aliases": [
"A-196085005",
"ASB-A-196085005",
"CVE-2020-13113"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/libexif/exif",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "edad134a28caaa7ea324b8c075bde52da05ad7d9"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libexif_project:libexif:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.6.22"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"cvs-migration",
"exif-0_6_21-release",
"exif-0_6_20-release",
"exif-0_6_19-release",
"exif-0_6_18-release",
"exif-0_6_17-release",
"exif-0_6_15-release",
"exif-0_6_9-release",
"exif-0_6-release"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13113.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/libexif/libexif",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "3cc7842ca200a4da4bd65850e3c20d5a1811afa7"
},
{
"fixed": "ec412aa4583ad71ecabb967d3c77162760169d1f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libexif_project:libexif:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.6.22"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "ec412aa4583ad71ecabb967d3c77162760169d1f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"cvs-migration",
"libexif-0_6_21-release",
"libexif-0_6_20-release",
"libexif-0_6_19-release",
"libexif-0_6_18-release",
"libexif-0_6_17-release",
"libexif-0_6_16-release",
"libexif-0_6_15-release",
"libexif-0_6_14-release",
"libexif-0_6_12-release",
"libexif-before-0_6_0-api-change",
"libexif-0_5_9-release",
"libexif-0_5_7-release",
"libexif-0_5_7-rc4",
"libexif-0_5_7-rc3",
"libexif-0_5_7-rc2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13113.json",
"vanir_signatures": [
{
"id": "CVE-2020-13113-94b8b898",
"digest": {
"threshold": 0.9,
"line_hashes": [
"63090266439464873986942635232246469126",
"133352749772712821961584651055235107129",
"87180012295696138925344357238405859904"
]
},
"source": "https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f",
"target": {
"file": "libexif/pentax/exif-mnote-data-pentax.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-13113-a2502673",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171665474353090061899021564791197257152",
"116301063513059510679027604740839939787",
"33983948157538593294138539723360334410",
"231840623465655071498280023479608178034"
]
},
"source": "https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f",
"target": {
"file": "libexif/olympus/exif-mnote-data-olympus.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-13113-a2eb331e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"63090266439464873986942635232246469126",
"225602874433340598213515522161546468010",
"215464518781960057437098919856189329355"
]
},
"source": "https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f",
"target": {
"file": "libexif/canon/exif-mnote-data-canon.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-13113-af3fbf42",
"digest": {
"length": 3532,
"function_hash": "60821619512570704490696459539065569381"
},
"source": "https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f",
"target": {
"file": "libexif/pentax/exif-mnote-data-pentax.c",
"function": "exif_mnote_data_pentax_load"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-13113-b11b808f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"63090266439464873986942635232246469126",
"133352749772712821961584651055235107129",
"59814921405938895402439206079570764350"
]
},
"source": "https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f",
"target": {
"file": "libexif/fuji/exif-mnote-data-fuji.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-13113-b8c82fdb",
"digest": {
"length": 2842,
"function_hash": "20638438429645367164789719521734894738"
},
"source": "https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f",
"target": {
"file": "libexif/fuji/exif-mnote-data-fuji.c",
"function": "exif_mnote_data_fuji_load"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-13113-d6752acb",
"digest": {
"length": 6180,
"function_hash": "287078706475236992644152500043678847654"
},
"source": "https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f",
"target": {
"file": "libexif/olympus/exif-mnote-data-olympus.c",
"function": "exif_mnote_data_olympus_load"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-13113-d9365afb",
"digest": {
"length": 2658,
"function_hash": "191996382206296598990556007166730683120"
},
"source": "https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f",
"target": {
"file": "libexif/canon/exif-mnote-data-canon.c",
"function": "exif_mnote_data_canon_load"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:05:20Z"
}
}
],
"modified": "2026-10-24T14:05:20.824814068Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html",
"https://security.gentoo.org/glsa/202007-05",
"https://usn.ubuntu.com/4396-1/",
"https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "12.04"
},
{
"last_affected": "12.04"
},
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "19.10"
},
{
"last_affected": "19.10"
},
{
"introduced": "20.04"
},
{
"last_affected": "20.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-13113",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442937,
"published_at": "2020-05-21T17:15:10.29+00:00"
}