Some memory corruption bugs were discovered in libraw, a raw image decoder library, which could be triggered via maliciously crafted input files to cause denial of service or other unspecified impact.

For Debian 7 'Wheezy', these problems have been fixed in version 0.14.6-2+deb7u2.

We recommend that you upgrade your libraw packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libraw: Memory corruption in the parse_tiff_ifd() (CVE-2017-6886)

  - There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw     0.18.2. It will lead to a remote denial of service attack. (CVE-2017-13735)

  - A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw     before 0.18.3. It could allow a remote denial of service or code execution attack. (CVE-2017-14265)

  - LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted     file. (CVE-2017-14348)

  - In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in     dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose     potentially sensitive memory or cause an application crash. (CVE-2017-14608)

  - An error related to the LibRaw::panasonic_load_raw() function (dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via     a specially crafted TIFF image. (CVE-2017-16909)

  - An error within the LibRaw::xtrans_interpolate() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause an invalid read memory access and subsequently a Denial of     Service condition. (CVE-2017-16910)

  - A boundary error within the parse_tiff_ifd() function (internal/dcraw_common.cpp) in LibRaw versions     before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with     model set to DSLR-A100 and containing multiple sequences of 0x100 and 0x14A TAGs. (CVE-2017-6887)

  - An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function     in libraw_cxx.cpp. (CVE-2018-10528)

  - An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table     list implementation in libraw_x3f.cpp and libraw_cxx.cpp. (CVE-2018-10529)

  - LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20364)

  - LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. (CVE-2018-20365)

  - An off-by-one error within the LibRaw::kodak_ycbcr_load_raw() function (internal/dcraw_common.cpp) in     LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently     cause a crash. (CVE-2018-5800)

  - An error within the LibRaw::unpack() function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7     can be exploited to trigger a NULL pointer dereference. (CVE-2018-5801)

  - An error within the kodak_radc_load_raw() function (internal/dcraw_common.cpp) related to the buf     variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access     and subsequently cause a crash. (CVE-2018-5802)

  - A boundary error within the quicktake_100_load_raw() function (internal/dcraw_common.cpp) in LibRaw     versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a     crash. (CVE-2018-5805)

  - An error within the leaf_hdr_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806)

  - An error within the rollei_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.
    (CVE-2018-5810)

  - An error within the parse_minolta() function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be     exploited to trigger an infinite loop via a specially crafted file. (CVE-2018-5813)

  - LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp,     postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example,     malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength. (CVE-2020-15503)

  - Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\src\postprocessing\aspect_ratio.cpp.
    (CVE-2020-22628)

  - Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
    (CVE-2020-24870)

  - In LibRaw, there is an out-of-bounds write vulnerability within the new_node() function     (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file. (CVE-2020-35530)

  - In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function     (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file. (CVE-2020-35531)

  - In LibRaw, an out-of-bounds read vulnerability exists within the simple_decode_row() function     (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field.
    (CVE-2020-35532)

  - In LibRaw, an out-of-bounds read vulnerability exists within the LibRaw::adobe_copy_pixel() function     (libraw\src\decoders\dng.cpp) when reading data from the image file. (CVE-2020-35533)

  - In LibRaw, there is a memory corruption vulnerability within the crxFreeSubbandData() function     (libraw\src\decoders\crx.cpp) when processing cr3 files. (CVE-2020-35534)

  - In LibRaw, there is an out-of-bounds read vulnerability within the LibRaw::parseSonySRF() function     (libraw\src\metadata\sony.cpp) when processing srf files. (CVE-2020-35535)

  - A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file     may lead to an application crash. (CVE-2023-1729)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for libraw fixes the following issues :

  - CVE-2015-3885: A specially crafted raw image file could     have caused a Denial of Service through an integer     overflow. (bsc#930683)

  - CVE-2015-8367: The function phase_one_correct() did not     handle memory object initialization correctly, which may     have caused some other problems. (bsc#957517)

  - CVE-2017-6886: memory corruption in parse_tiff_ifd()     func (internal/dcraw_common.cpp) could lead to Denial of     service (bsc#1039380)

  - CVE-2017-6889: integer overflow error within the     'foveon_load_camf()' function (dcraw_foveon.c) could     lead to Denial of service (bsc#1039210)

  - CVE-2017-6890: boundary error within the     'foveon_load_camf()' function (dcraw_foveon.c)     (bsc#1039209)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libraw fixes the following issues :

  - CVE-2017-6890: A boundary error within the     'foveon_load_camf()' function was fixed. [boo#1039209]

  - CVE-2017-6889: An integer overflow error within the     'foveon_load_camf()' function was fixed. [boo#1039210]

  - CVE-2017-6887: A memory corruption via e.g. a specially     crafted KDC file parse_tiff_ifd() was fixed.
    [boo#1039379]

  - CVE-2017-6886: A memory corruption in parse_tiff_ifd()     function was fixed. [boo#1039380]

Hossein Lotfi and Jakub Jirasek from Secunia Research have discovered multiple vulnerabilities in LibRaw, a library for reading RAW images.
An attacker could cause a memory corruption leading to a DoS (Denial of Service) with craft KDC or TIFF file.

It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, a remote attacker could cause applications linked against LibRaw to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
102481	Debian DLA-1057-1 : libraw security update	Nessus	Debian Local Security Checks	8/15/2017	1/11/2021	critical
195750	RHEL 7 : libraw (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
102855	SUSE SLED12 Security Update : libraw (SUSE-SU-2017:2300-1)	Nessus	SuSE Local Security Checks	8/31/2017	1/6/2021	critical
100567	openSUSE Security Update : libraw (openSUSE-2017-640)	Nessus	SuSE Local Security Checks	6/1/2017	1/19/2021	critical
102630	Debian DSA-3950-1 : libraw - security update	Nessus	Debian Local Security Checks	8/22/2017	1/4/2021	critical
104785	Ubuntu 14.04 LTS / 16.04 LTS : LibRaw vulnerabilities (USN-3492-1)	Nessus	Ubuntu Local Security Checks	11/27/2017	10/20/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical