PT-2019-4977 · Libraw+3 · Libraw+3

Publicado 2018-11-23 · Atualizado 2022-01-29 · CVE-2018-5817

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.19.1

Description A type confusion error within the unpacked load raw() function can be exploited to trigger an infinite loop, potentially leading to a denial of service. This issue is related to errors in type conversion.

Recommendations For versions prior to 0.19.1, update to version 0.19.1 or later to resolve the issue. As a temporary workaround, consider disabling the unpacked load raw() function until a patch is available.

Correção

Incorrect Type Conversion or Cast

Enumeração de Fraquezas

CWE-704

Identificadores relacionados

ALT-PU-2018-2684

BDU:2020-01600

CVE-2018-5817

DLA-1734-1

DLA-2903-1

OPENSUSE-SU-2019:0094-1

OPENSUSE-SU-2019_0094-1

SUSE-SU-2019:0127-1

SUSE-SU-2019:0133-1

USN-3989-1

Produtos afetados

Alt Linux

Libraw

Suse

Ubuntu

Referências · 114

• https://github.com/LibRaw/LibRaw/issues/193 · Nota
• https://github.com/LibRaw/LibRaw/issues/194 · Nota
• https://github.com/LibRaw/LibRaw/issues/195 · Nota
• https://github.com/LibRaw/LibRaw/issues/192 · Nota
• https://bdu.fstec.ru/vul/2022-05954 · Nota de Segurança
• https://bdu.fstec.ru/vul/2022-05958 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-01601 · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5817 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-5818 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5806 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5805 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-5817.html · Nota
• https://suse.com/security/cve/CVE-2018-5819.html · Nota
• https://bdu.fstec.ru/vul/2022-05866 · Nota de Segurança