PT-2023-3275 · Libraw+8 · Libraw+8

Daisypoop · Publicado 2023-05-15 · Atualizado 2025-03-20 · CVE-2023-1729

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibRaw (affected versions not specified)

Description The issue is related to a heap-buffer-overflow in the raw2image ex() function of the LibRaw library, which is used for image processing. This overflow can be caused by a maliciously crafted file, potentially leading to an application crash. The exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-119

CWE-787

Identificadores relacionados

ALSA-2024:2137

BDU:2023-03406

CVE-2023-1729

DLA-3433-1

DSA-5412-1

INFSA-2024_2137

OESA-2023-1280

OPENSUSE-SU-2024:12901-1

RHSA-2024:2137

RHSA-2024_2137

SUSE-SU-2023:2194-1

SUSE-SU-2023:2195-1

SUSE-SU-2023:2196-1

SUSE-SU-2023_2194-1

SUSE-SU-2023_2196-1

USN-6137-1

USN-7266-1

Produtos afetados

Almalinux

Astra Linux

Libraw

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Referências · 62

• 🔥 https://github.com/LibRaw/LibRaw/issues/557 · Exploit
• https://suse.com/support/update/announcement/2023/suse-su-20232194-1 · Nota
• https://altsp.su/obnovleniya-bezopasnosti · Nota
• https://suse.com/support/update/announcement/2023/suse-su-20232196-1 · Nota
• https://security.gentoo.org/glsa/202312-08 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2020-22628 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-7266-1 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Aviso do Fabricante
• https://errata.almalinux.org/9/ALSA-2024-2137.html · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E5ZJ3UBTJBZHNPJQFOSGM5L7WAHHE2GY · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2020-35533 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-1729 · Nota
• https://ubuntu.com/security/CVE-2021-32142 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AGZ6XF5WTPJ4GLXQ62JVRDZSVSJHXNQU · Aviso do Fabricante