Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.

libkdcraw was updated to fix a possible double-free() on error recovery on damaged full-color (Foveon, sRAW) files. (CVE-2013-2126)

This update of darktable fixes a problem inside the embedded libraw version.

  - Fix for CVE-2013-2126

  - added backported patch from git master     0001-fixed-error-handling-for-broken-full-color-images.p     atch fixes bnc#823114-

This update of libraw fixes a security issue.

  - security update :

  - CVE-2013-2126.patch [bnc#822665]

The remote host is affected by the vulnerability described in GLSA-201309-09 (LibRaw, libkdcraw: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in LibRaw and libkdcraw.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file,       possibly resulting in arbitrary code execution or Denial of Service.
  Workaround :

    There is no known workaround at this time.

KDE released updates for its Workspaces, Applications, and Development Platform. These updates are the last in a series of monthly stabilization updates to the 4.10 series. 4.10.5 updates bring many bugfixes on top of the latest edition in the 4.10 series and are recommended updates for everyone running 4.10.4 or earlier versions.
See also: http://kde.org/announcements/announce-4.10.5.php

Fix for CVE-2013-2126, double-free flaw when handling damaged full-color in Foveon and sRAW files

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2013-2126, double-free flaw when handling damaged full-color in Foveon and sRAW files

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libKDcraw incorrectly handled broken full-color images. If a user or automated system were tricked into processing a specially crafted raw image, applications linked against libKDcraw could be made to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LibRaw incorrectly handled broken full-color images. If a user or automated system were tricked into processing a specially crafted raw image, applications linked against LibRaw could be made to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75078	openSUSE Security Update : libkdcraw (openSUSE-SU-2013:1168-1)	Nessus	SuSE Local Security Checks	high
75060	openSUSE Security Update : darktable (openSUSE-SU-2013:1083-1)	Nessus	SuSE Local Security Checks	high
75059	openSUSE Security Update : libraw (openSUSE-SU-2013:1085-1)	Nessus	SuSE Local Security Checks	high
69900	GLSA-201309-09 : LibRaw, libkdcraw: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69153	Fedora 17 : analitza-4.10.5-1.fc17 / ark-4.10.5-1.fc17 / audiocd-kio-4.10.5-1.fc17 / etc (2013-13499)	Nessus	Fedora Local Security Checks	high
69027	Fedora 18 : analitza-4.10.5-1.fc18 / ark-4.10.5-1.fc18 / audiocd-kio-4.10.5-1.fc18 / etc (2013-13112)	Nessus	Fedora Local Security Checks	high
69026	Fedora 19 : libkdcraw-4.10.5-2.fc19 (2013-13038)	Nessus	Fedora Local Security Checks	high
66923	Ubuntu 12.04 LTS : libkdcraw vulnerability (USN-1885-1)	Nessus	Ubuntu Local Security Checks	high
66922	Ubuntu 12.04 LTS / 12.10 / 13.04 : libraw vulnerability (USN-1884-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2013-2126

high

Tenable Plugins

high

high

high

high

high

high

high

high

high