Secunia Research reports :

CVE-2017-16909: An error related to the 'LibRaw::panasonic_load_raw()' function (dcraw_common.cpp) can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image.

CVE-2017-16910: An error within the 'LibRaw::xtrans_interpolate()' function (internal/dcraw_common.cpp) can be exploited to cause an invalid read memory access.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2903 advisory.

  - In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in     dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose     potentially sensitive memory or cause an application crash. (CVE-2017-14608)

  - An error related to the LibRaw::panasonic_load_raw() function (dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via     a specially crafted TIFF image. (CVE-2017-16909)

  - An error within the LibRaw::xtrans_interpolate() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause an invalid read memory access and subsequently a Denial of     Service condition. (CVE-2017-16910)

  - LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20363)

  - LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20364)

  - LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. (CVE-2018-20365)

  - An off-by-one error within the LibRaw::kodak_ycbcr_load_raw() function (internal/dcraw_common.cpp) in     LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently     cause a crash. (CVE-2018-5800)

  - An error within the LibRaw::unpack() function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7     can be exploited to trigger a NULL pointer dereference. (CVE-2018-5801)

  - An error within the kodak_radc_load_raw() function (internal/dcraw_common.cpp) related to the buf     variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access     and subsequently cause a crash. (CVE-2018-5802)

  - A type confusion error within the identify() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.8 can be exploited to trigger a division by zero. (CVE-2018-5804)

  - A boundary error within the quicktake_100_load_raw() function (internal/dcraw_common.cpp) in LibRaw     versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a     crash. (CVE-2018-5805)

  - An error within the leaf_hdr_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806)

  - An error within the samsung_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.
    (CVE-2018-5807)

  - An error within the find_green() function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9     can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.
    (CVE-2018-5808)

  - An error within the rollei_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.
    (CVE-2018-5810)

  - An error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a     crash. (CVE-2018-5811)

  - An error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.9 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5812)

  - An error within the parse_minolta() function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be     exploited to trigger an infinite loop via a specially crafted file. (CVE-2018-5813)

  - An integer overflow error within the parse_qt() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.12 can be exploited to trigger an infinite loop via a specially crafted Apple QuickTime     file. (CVE-2018-5815)

  - A type confusion error within the unpacked_load_raw() function within LibRaw versions prior to 0.19.1     (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop. (CVE-2018-5817)

  - An error within the parse_rollei() function (internal/dcraw_common.cpp) within LibRaw versions prior to     0.19.1 can be exploited to trigger an infinite loop. (CVE-2018-5818)

  - An error within the parse_sinar_ia() function (internal/dcraw_common.cpp) within LibRaw versions prior     to 0.19.1 can be exploited to exhaust available CPU resources. (CVE-2018-5819)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libraw fixes the following issues: Security issues fixed :

  - CVE-2017-13735: A floating point exception in     kodak_radc_load_raw could be used by attackers to crash     a libraw using application (bsc#1060321)

  - CVE-2017-14608: An out-of-bounds read in the     kodak_65000_load_raw function could be used for crashing     or information leak from the libraw library     (bsc#1063798)

  - CVE-2017-16909: Fix heap-buffer overflow in the     LibRaw::panasonic_load_raw() function (bsc#1072385).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, a remote attacker could cause applications linked against LibRaw to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
106858	FreeBSD : libraw -- multiple DoS vulnerabilities (c60804f1-126f-11e8-8b5b-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	2/16/2018	12/31/2018	high
158247	Debian DLA-2903-1 : libraw - LTS security update	Nessus	Debian Local Security Checks	2/22/2022	11/7/2023	critical
105459	SUSE SLED12 Security Update : libraw (SUSE-SU-2017:3392-1)	Nessus	SuSE Local Security Checks	12/26/2017	1/6/2021	critical
108832	Ubuntu 14.04 LTS / 16.04 LTS : LibRaw vulnerabilities (USN-3615-1)	Nessus	Ubuntu Local Security Checks	4/4/2018	10/20/2023	high

Detections

Analytics

Plugins Search

high

critical

critical

high