https://www.libraw.org/news/libraw-0-18-11

----

CVE-2018-10529 fixed: out of bounds read in X3F parser CVE-2018-10528 fixed: possible stack overrun in X3F parser

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - LibRaw: Stack-based buffer overflow in quicktake_100_load_raw() function in internal/dcraw_common.cpp     (CVE-2018-5805)

  - An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table     list implementation in libraw_x3f.cpp and libraw_cxx.cpp. (CVE-2018-10529)

  - LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20363)

  - LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20364)

  - LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. (CVE-2018-20365)

  - An error within the leaf_hdr_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806)

  - An error within the parse_minolta() function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be     exploited to trigger an infinite loop via a specially crafted file. (CVE-2018-5813)

  - A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file     may lead to an application crash. (CVE-2023-1729)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Update to LibRaw-0.18.10, see https://www.libraw.org/news/libraw-0-18-10 for details.

----

Update to LibRaw-0.18.9, see https://www.libraw.org/news/libraw-0-18-9 for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libraw: Memory corruption in the parse_tiff_ifd() (CVE-2017-6886)

  - There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw     0.18.2. It will lead to a remote denial of service attack. (CVE-2017-13735)

  - A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw     before 0.18.3. It could allow a remote denial of service or code execution attack. (CVE-2017-14265)

  - LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted     file. (CVE-2017-14348)

  - In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in     dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose     potentially sensitive memory or cause an application crash. (CVE-2017-14608)

  - An error related to the LibRaw::panasonic_load_raw() function (dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via     a specially crafted TIFF image. (CVE-2017-16909)

  - An error within the LibRaw::xtrans_interpolate() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause an invalid read memory access and subsequently a Denial of     Service condition. (CVE-2017-16910)

  - A boundary error within the parse_tiff_ifd() function (internal/dcraw_common.cpp) in LibRaw versions     before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with     model set to DSLR-A100 and containing multiple sequences of 0x100 and 0x14A TAGs. (CVE-2017-6887)

  - An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function     in libraw_cxx.cpp. (CVE-2018-10528)

  - An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table     list implementation in libraw_x3f.cpp and libraw_cxx.cpp. (CVE-2018-10529)

  - LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20364)

  - LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. (CVE-2018-20365)

  - An off-by-one error within the LibRaw::kodak_ycbcr_load_raw() function (internal/dcraw_common.cpp) in     LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently     cause a crash. (CVE-2018-5800)

  - An error within the LibRaw::unpack() function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7     can be exploited to trigger a NULL pointer dereference. (CVE-2018-5801)

  - An error within the kodak_radc_load_raw() function (internal/dcraw_common.cpp) related to the buf     variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access     and subsequently cause a crash. (CVE-2018-5802)

  - A boundary error within the quicktake_100_load_raw() function (internal/dcraw_common.cpp) in LibRaw     versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a     crash. (CVE-2018-5805)

  - An error within the leaf_hdr_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806)

  - An error within the rollei_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.
    (CVE-2018-5810)

  - An error within the parse_minolta() function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be     exploited to trigger an infinite loop via a specially crafted file. (CVE-2018-5813)

  - LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp,     postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example,     malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength. (CVE-2020-15503)

  - Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\src\postprocessing\aspect_ratio.cpp.
    (CVE-2020-22628)

  - Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
    (CVE-2020-24870)

  - In LibRaw, there is an out-of-bounds write vulnerability within the new_node() function     (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file. (CVE-2020-35530)

  - In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function     (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file. (CVE-2020-35531)

  - In LibRaw, an out-of-bounds read vulnerability exists within the simple_decode_row() function     (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field.
    (CVE-2020-35532)

  - In LibRaw, an out-of-bounds read vulnerability exists within the LibRaw::adobe_copy_pixel() function     (libraw\src\decoders\dng.cpp) when reading data from the image file. (CVE-2020-35533)

  - In LibRaw, there is a memory corruption vulnerability within the crxFreeSubbandData() function     (libraw\src\decoders\crx.cpp) when processing cr3 files. (CVE-2020-35534)

  - In LibRaw, there is an out-of-bounds read vulnerability within the LibRaw::parseSonySRF() function     (libraw\src\metadata\sony.cpp) when processing srf files. (CVE-2020-35535)

  - A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file     may lead to an application crash. (CVE-2023-1729)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for libraw fixes the following issues :

  - CVE-2018-10528: A stack-based buffer overflow in the     utf2char function in libraw_cxx.cpp was fixed.
    [boo#1091345]

  - CVE-2018-10529: A out-of-bounds read affecting the X3F     property table list implementation in libraw_x3f.cpp and     libraw_cxx.cpp was fixed. [boo#1091346]

It was discovered that LibRaw incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code.
(CVE-2018-10528)

It was discovered that LibRaw incorrectly handled certain files. An attacker could possibly use this to obtain sensitive information.
(CVE-2018-10529).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
109817	Fedora 27 : LibRaw (2018-08ea7a5f0b)	Nessus	Fedora Local Security Checks	5/16/2018	1/6/2021	high
195759	RHEL 8 : libraw (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
120820	Fedora 28 : mingw-LibRaw (2018-d3b44e5574)	Nessus	Fedora Local Security Checks	1/3/2019	1/6/2021	high
120597	Fedora 28 : LibRaw (2018-8c4e0b4335)	Nessus	Fedora Local Security Checks	1/3/2019	1/6/2021	high
109876	Fedora 27 : mingw-LibRaw (2018-ccb2cc96be)	Nessus	Fedora Local Security Checks	5/17/2018	1/6/2021	high
195750	RHEL 7 : libraw (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
109538	openSUSE Security Update : libraw (openSUSE-2018-413)	Nessus	SuSE Local Security Checks	5/3/2018	1/19/2021	high
109648	Ubuntu 16.04 LTS / 18.04 LTS : LibRaw vulnerabilities (USN-3639-1)	Nessus	Ubuntu Local Security Checks	5/9/2018	10/20/2023	high
109926	Fedora 26 : LibRaw (2018-742a69ccc3)	Nessus	Fedora Local Security Checks	5/21/2018	1/6/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

high

high

high