PT-2018-3832 · Libraw+3 · Libraw+3

Alextutubalin · Publicado 2018-05-10 · Atualizado 2024-06-15 · CVE-2018-5813

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.18.11

Description The issue is related to an error in the parse minolta() function within the dcraw/dcraw.c component of the LibRaw image processing library. This error can be exploited by a remote attacker using a specially crafted file to trigger an infinite loop, leading to a denial of service.

Recommendations For versions prior to 0.18.11, update to version 0.18.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of the parse minolta() function in the dcraw/dcraw.c component until a patch is available.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

ALT-PU-2018-1695

BDU:2022-05954

CVE-2018-5813

DLA-2903-1

OPENSUSE-SU-2018_2286-1

OPENSUSE-SU-2019:0008-1

OPENSUSE-SU-2019_0008-1

OPENSUSE-SU-2024:10980-1

SUSE-SU-2018:3343-1

SUSE-SU-2019:0005-1

USN-3838-1

Produtos afetados

Alt Linux

Libraw

Suse

Ubuntu

Referências · 57

• https://github.com/LibRaw/LibRaw/commit/e47384546b43d0fd536e933249047bc397a4d88b · Correção
• https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt · Nota
• https://suse.com/security/cve/CVE-2018-5804 · Nota
• https://ubuntu.com/security/CVE-2018-5807 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-5810 · Nota
• https://suse.com/security/cve/CVE-2018-5815 · Nota
• https://secuniaresearch.flexerasoftware.com/advisories/83050 · Nota
• https://ubuntu.com/security/CVE-2018-5811 · Aviso do Fabricante
• https://bugzilla.suse.com/1103353 · Nota
• https://secuniaresearch.flexerasoftware.com/secunia_research/2018-13 · Nota
• https://suse.com/security/cve/CVE-2018-5819 · Nota
• https://osv.dev/vulnerability/CVE-2018-5813 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-20337 · Nota
• https://suse.com/security/cve/CVE-2017-6887 · Nota
• https://suse.com/security/cve/CVE-2018-5802 · Nota