Fedora 19 : LibRaw-0.14.8-3.fc19.20120830git98d925 (2013-15562)
Medium Nessus Plugin ID 69820
SynopsisThe remote Fedora host is missing a security update.
DescriptionRaphael Geissert reported two denial of service flaws in LibRaw  :
Specially crafted photo files may trigger a division by zero, an infinite loop, or a NULL pointer dereference in libraw leading to denial of service in applications using the library. These vulnerabilities appear to originate in dcraw and as such any program or library based on it is affected. To name a few confirmed applications: dcraw, ufraw. Other affected software: shotwell, darktable, and libkdcraw (Qt-style interface to libraw, using embedded copy) which is used by digikam.
Google Picasa apparently uses dcraw/ufraw so it might be affected.
dcraw's homepage has a list of applications that possibly still use it: http://cybercom.net/~dcoffin/dcraw/
Affected versions of libraw: confirmed: 0.8-0.15.3; but it is likely that all versions are affected.
Fixed in: libraw 0.15.4
Specially crafted photo files may trigger a series of conditions in which a NULL pointer is dereferenced leading to denial of service in applications using the library. These three vulnerabilities are in/related to the 'faster LJPEG decoder', which upstream states was introduced in LibRaw 0.13 and support for which is going to be dropped in 0.16.
Affected versions of libraw: 0.13.x-0.15.x
Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected LibRaw package.