Medium severity · published Feb 14, 2005
CVE-2005-0406
A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive…
5.5
CVSS
0.5%
EPSS
No
On KEV
Description
A design flaw in image processing software that modifies JPEG images might not modify the original EXIF thumbnail, which could lead to an information leak of potentially sensitive visual information that had been removed from the main JPEG image.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Image Processing · Image Processing Project
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0406
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0406
Mailing List
http://seclists.org/lists/fulldisclosure/2005/Feb/0343.html
Exploit
http://www.redteam-pentesting.de/advisories/rt-sa-2005-008.txt
More from Image Processing
9.8
CVE-2022-24720
image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick
5.5
CVE-2020-21573
An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted image file