From efafa6bb74153f9ee54a858b8e8f24dafcd8a75d Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Mon, 13 Apr 2026 08:18:47 +0000 Subject: [PATCH] Patch libexif for CVE-2026-40386, CVE-2026-40385 --- SPECS/libexif/CVE-2026-40385.patch | 33 ++++++++++++++++++++++ SPECS/libexif/CVE-2026-40386.patch | 44 ++++++++++++++++++++++++++++++ SPECS/libexif/libexif.spec | 7 ++++- 3 files changed, 83 insertions(+), 1 deletion(-) create mode 100644 SPECS/libexif/CVE-2026-40385.patch create mode 100644 SPECS/libexif/CVE-2026-40386.patch diff --git a/SPECS/libexif/CVE-2026-40385.patch b/SPECS/libexif/CVE-2026-40385.patch new file mode 100644 index 00000000000..4bb282d2df8 --- /dev/null +++ b/SPECS/libexif/CVE-2026-40385.patch @@ -0,0 +1,33 @@ +From 4c475dc4c9020995382e342b24005330bcbcd1ef Mon Sep 17 00:00:00 2001 +From: Marcus Meissner +Date: Fri, 3 Apr 2026 11:18:47 +0200 +Subject: [PATCH] Avoid overflow on 32bit system when reading Nikon MakerNotes + +The addition o2 = datao + exif_get_long(buf + o2, n->order) +could have overflowed on systems with 32bit unsigned int size_t. + +This could have caused out of bound reads of data, leading to +misparsing of exif / crashes. + +Reported-By: Kerwin +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libexif/libexif/commit/93003b93e50b3d259bd2227d8775b73a53c35d58.patch +--- + libexif/olympus/exif-mnote-data-olympus.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c +index 6067b9e..bdeb5a9 100644 +--- a/libexif/olympus/exif-mnote-data-olympus.c ++++ b/libexif/olympus/exif-mnote-data-olympus.c +@@ -382,6 +382,7 @@ exif_mnote_data_olympus_load (ExifMnoteData *en, + o2 += 2; + + /* Go to where the number of entries is. */ ++ if (CHECKOVERFLOW(o2,buf_size,exif_get_long (buf + o2, n->order))) return; + o2 = datao + exif_get_long (buf + o2, n->order); + break; + +-- +2.45.4 + diff --git a/SPECS/libexif/CVE-2026-40386.patch b/SPECS/libexif/CVE-2026-40386.patch new file mode 100644 index 00000000000..1effbec9a53 --- /dev/null +++ b/SPECS/libexif/CVE-2026-40386.patch @@ -0,0 +1,44 @@ +From 4e39be50fea6fe55cc9d4dd719a947b4c8193c13 Mon Sep 17 00:00:00 2001 +From: Marcus Meissner +Date: Thu, 2 Apr 2026 13:26:31 +0200 +Subject: [PATCH] fixed 2 unsigned integer underflows + +this could cause crashes or data leaks. + +Reported-by: Kerwin +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libexif/libexif/commit/dc6eac6e9655d14d0779d99e82d0f5f442d2f34b.patch +--- + libexif/fuji/exif-mnote-data-fuji.c | 2 +- + libexif/olympus/exif-mnote-data-olympus.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/libexif/fuji/exif-mnote-data-fuji.c b/libexif/fuji/exif-mnote-data-fuji.c +index e3af4e1..3f295d3 100644 +--- a/libexif/fuji/exif-mnote-data-fuji.c ++++ b/libexif/fuji/exif-mnote-data-fuji.c +@@ -68,7 +68,7 @@ exif_mnote_data_fuji_get_value (ExifMnoteData *d, unsigned int i, char *val, uns + ExifMnoteDataFuji *n = (ExifMnoteDataFuji *) d; + + if (!d || !val) return NULL; +- if (i > n->count -1) return NULL; ++ if (i >= n->count) return NULL; + /* + exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataFuji", + "Querying value for tag '%s'...", +diff --git a/libexif/olympus/exif-mnote-data-olympus.c b/libexif/olympus/exif-mnote-data-olympus.c +index 3dbe1d3..6067b9e 100644 +--- a/libexif/olympus/exif-mnote-data-olympus.c ++++ b/libexif/olympus/exif-mnote-data-olympus.c +@@ -76,7 +76,7 @@ exif_mnote_data_olympus_get_value (ExifMnoteData *d, unsigned int i, char *val, + ExifMnoteDataOlympus *n = (ExifMnoteDataOlympus *) d; + + if (!d || !val) return NULL; +- if (i > n->count -1) return NULL; ++ if (i >= n->count) return NULL; + /* + exif_log (d->log, EXIF_LOG_CODE_DEBUG, "ExifMnoteDataOlympus", + "Querying value for tag '%s'...", +-- +2.45.4 + diff --git a/SPECS/libexif/libexif.spec b/SPECS/libexif/libexif.spec index 53cef333e04..bfb83267808 100644 --- a/SPECS/libexif/libexif.spec +++ b/SPECS/libexif/libexif.spec @@ -1,13 +1,15 @@ Summary: Library for extracting extra information from image files Name: libexif Version: 0.6.24 -Release: 2%{?dist} +Release: 3%{?dist} License: LGPLv2+ Vendor: Microsoft Corporation Distribution: Azure Linux URL: https://libexif.github.io/ Source0: https://github.com/libexif/libexif/releases/download/v%{version}/%{name}-%{version}.tar.bz2 Patch0: CVE-2026-32775.patch +Patch1: CVE-2026-40385.patch +Patch2: CVE-2026-40386.patch BuildRequires: doxygen BuildRequires: gcc BuildRequires: gettext-devel @@ -71,6 +73,9 @@ iconv -f latin1 -t utf-8 < README > README.utf8; cp README.utf8 README %doc libexif-api.html %changelog +* Mon Apr 13 2026 Azure Linux Security Servicing Account - 0.6.24-3 +- Patch for CVE-2026-40386, CVE-2026-40385 + * Mon Mar 16 2026 Azure Linux Security Servicing Account - 0.6.24-2 - Patch for CVE-2026-32775