LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2903 advisory.

  - In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in     dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose     potentially sensitive memory or cause an application crash. (CVE-2017-14608)

  - An error related to the LibRaw::panasonic_load_raw() function (dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via     a specially crafted TIFF image. (CVE-2017-16909)

  - An error within the LibRaw::xtrans_interpolate() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause an invalid read memory access and subsequently a Denial of     Service condition. (CVE-2017-16910)

  - LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20363)

  - LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20364)

  - LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. (CVE-2018-20365)

  - An off-by-one error within the LibRaw::kodak_ycbcr_load_raw() function (internal/dcraw_common.cpp) in     LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently     cause a crash. (CVE-2018-5800)

  - An error within the LibRaw::unpack() function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7     can be exploited to trigger a NULL pointer dereference. (CVE-2018-5801)

  - An error within the kodak_radc_load_raw() function (internal/dcraw_common.cpp) related to the buf     variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access     and subsequently cause a crash. (CVE-2018-5802)

  - A type confusion error within the identify() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.8 can be exploited to trigger a division by zero. (CVE-2018-5804)

  - A boundary error within the quicktake_100_load_raw() function (internal/dcraw_common.cpp) in LibRaw     versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a     crash. (CVE-2018-5805)

  - An error within the leaf_hdr_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806)

  - An error within the samsung_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.
    (CVE-2018-5807)

  - An error within the find_green() function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9     can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.
    (CVE-2018-5808)

  - An error within the rollei_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.
    (CVE-2018-5810)

  - An error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a     crash. (CVE-2018-5811)

  - An error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.9 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5812)

  - An error within the parse_minolta() function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be     exploited to trigger an infinite loop via a specially crafted file. (CVE-2018-5813)

  - An integer overflow error within the parse_qt() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.12 can be exploited to trigger an infinite loop via a specially crafted Apple QuickTime     file. (CVE-2018-5815)

  - A type confusion error within the unpacked_load_raw() function within LibRaw versions prior to 0.19.1     (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop. (CVE-2018-5817)

  - An error within the parse_rollei() function (internal/dcraw_common.cpp) within LibRaw versions prior to     0.19.1 can be exploited to trigger an infinite loop. (CVE-2018-5818)

  - An error within the parse_sinar_ia() function (internal/dcraw_common.cpp) within LibRaw versions prior     to 0.19.1 can be exploited to exhaust available CPU resources. (CVE-2018-5819)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the LibRaw package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1     has a NULL pointer dereference.(CVE-2018-20363)

  - LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1     has a NULL pointer dereference.(CVE-2018-20364)

  - LibRaw::raw2image() in libraw_cxx.cpp has a heap-based     buffer overflow.(CVE-2018-20365)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, a remote attacker could cause applications linked against LibRaw to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libraw fixes the following issues :

Security issues fixed :

  - CVE-2018-20337: Fixed a stack-based buffer overflow in     the parse_makernote function of dcraw_common.cpp     (bsc#1120519)

  - CVE-2018-20365: Fixed a heap-based buffer overflow in     the raw2image function of libraw_cxx.cpp (bsc#1120500)

  - CVE-2018-20364: Fixed a NULL pointer dereference in the     copy_bayer function of libraw_cxx.cpp (bsc#1120499)

  - CVE-2018-20363: Fixed a NULL pointer dereference in the     raw2image function of libraw_cxx.cpp (bsc#1120498) 

  - CVE-2018-5817: Fixed an infinite loop in the     unpacked_load_raw function of dcraw_common.cpp     (bsc#1120515)

  - CVE-2018-5818: Fixed an infinite loop in the     parse_rollei function of dcraw_common.cpp (bsc#1120516) 

  - CVE-2018-5819: Fixed a denial of service in the     parse_sinar_ia function of dcraw_common.cpp     (bsc#1120517)

This update was imported from the SUSE:SLE-15:Update update project.

This update for libraw fixes the following issues :

Security issues fixed :

CVE-2018-20337: Fixed a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp (bsc#1120519)

CVE-2018-20365: Fixed a heap-based buffer overflow in the raw2image function of libraw_cxx.cpp (bsc#1120500)

CVE-2018-20364: Fixed a NULL pointer dereference in the copy_bayer function of libraw_cxx.cpp (bsc#1120499)

CVE-2018-20363: Fixed a NULL pointer dereference in the raw2image function of libraw_cxx.cpp (bsc#1120498)

CVE-2018-5817: Fixed an infinite loop in the unpacked_load_raw function of dcraw_common.cpp (bsc#1120515)

CVE-2018-5818: Fixed an infinite loop in the parse_rollei function of dcraw_common.cpp (bsc#1120516)

CVE-2018-5819: Fixed a denial of service in the parse_sinar_ia function of dcraw_common.cpp (bsc#1120517)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libraw fixes the following issues :

Security issues fixed :

CVE-2018-20365: Fixed a heap-based buffer overflow in the raw2image function of libraw_cxx.cpp (bsc#1120500)

CVE-2018-20364: Fixed a NULL pointer dereference in the copy_bayer function of libraw_cxx.cpp (bsc#1120499)

CVE-2018-20363: Fixed a NULL pointer dereference in the raw2image function of libraw_cxx.cpp (bsc#1120498)

CVE-2018-5817: Fixed an infinite loop in the unpacked_load_raw function of dcraw_common.cpp (bsc#1120515)

CVE-2018-5818: Fixed an infinite loop in the parse_rollei function of dcraw_common.cpp (bsc#1120516)

CVE-2018-5819: Fixed a denial of service in the parse_sinar_ia function of dcraw_common.cpp (bsc#1120517)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes for CVE-2018-20337, CVE-2018-20363, CVE-2018-20364, CVE-2018-20365

https://www.libraw.org/news/libraw-0-19-2-release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
158247	Debian DLA-2903-1 : libraw - LTS security update	Nessus	Debian Local Security Checks	critical
139967	EulerOS 2.0 SP8 : LibRaw (EulerOS-SA-2020-1864)	Nessus	Huawei Local Security Checks	medium
125337	Ubuntu 16.04 LTS / 18.04 LTS : LibRaw vulnerabilities (USN-3989-1)	Nessus	Ubuntu Local Security Checks	high
121461	openSUSE Security Update : libraw (openSUSE-2019-94)	Nessus	SuSE Local Security Checks	high
121301	SUSE SLED15 / SLES15 Security Update : libraw (SUSE-SU-2019:0133-1)	Nessus	SuSE Local Security Checks	high
121297	SUSE SLED12 Security Update : libraw (SUSE-SU-2019:0127-1)	Nessus	SuSE Local Security Checks	high
120569	Fedora 29 : LibRaw (2018-801432b551)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-20365

medium

Tenable Plugins

critical

medium

high

high

high

high

high