PT-2017-17396 · Libraw+3 · Libraw+3

Alextutubalin · Publicado 2017-03-13 · Atualizado 2024-06-15 · CVE-2017-6887

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.18.2

Description A boundary error within the parse tiff ifd() function can be exploited to cause memory corruption via a specially crafted file, such as a KDC file with the model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.

Recommendations For versions prior to 0.18.2, update to version 0.18.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the parse tiff ifd() function until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2017-1273

CVE-2017-6887

DLA-1057-1

DSA-3950-1

MGASA-2017-0223

OPENSUSE-SU-2024:10980-1

SUSE-SU-2017:2300-1

USN-3492-1

Produtos afetados

Alt Linux

Libraw

Suse

Ubuntu

Referências · 55

• https://github.com/LibRaw/LibRaw/commit/d7c3d2cb460be10a3ea7b32e9443a83c243b2251 · Correção
• https://osv.dev/vulnerability/MGASA-2017-0223 · Aviso do Fabricante
• https://bugzilla.suse.com/957517 · Nota
• https://suse.com/security/cve/CVE-2017-6889 · Nota
• https://suse.com/security/cve/CVE-2018-5815 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=21004 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-6887 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2017-6887 · Nota
• https://osv.dev/vulnerability/ALPINE-CVE-2017-6887 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-8367 · Nota
• https://osv.dev/vulnerability/DSA-3950-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-8366 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-5819 · Nota
• http://securityfocus.com/bid/98592 · Nota
• https://bugzilla.suse.com/1039379 · Nota