PT-2018-3825 · Libraw+3 · Libraw+3

Alexutubalin · Publicado 2018-04-24 · Atualizado 2022-01-29 · CVE-2018-5812

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.18.9

Description The issue is related to errors in pointer dereferencing within the nikon coolscan load raw() function in the internal/dcraw common.cpp component of the LibRaw image processing library. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 0.18.9, update to version 0.18.9 or later to resolve the issue. As a temporary workaround, consider disabling the nikon coolscan load raw() function until a patch is available.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2018-1695

BDU:2022-05866

CVE-2018-5812

DLA-2903-1

OPENSUSE-SU-2018_2286-1

USN-3838-1

Produtos afetados

Alt Linux

Libraw

Suse

Ubuntu

Referências · 24

• https://github.com/LibRaw/LibRaw/commit/fd6330292501983ac75fe4162275794b18445bd9 · Correção
• https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt · Nota
• https://ubuntu.com/security/CVE-2018-5807 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-05866 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-5812 · Nota de Segurança
• https://secuniaresearch.flexerasoftware.com/secunia_research/2018-10 · Nota
• https://secuniaresearch.flexerasoftware.com/advisories/81800 · Nota
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-5811 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3838-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-5812 · Aviso do Fabricante
• https://usn.ubuntu.com/3838-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-5812 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-5816 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-5815 · Aviso do Fabricante