PT-2013-1243 · Dave Coffin · Libraw+1

Published 2013-08-30 · Updated 2016-11-28 · CVE-2013-1438

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dcraw versions 0.8.x through 0.8.9 libraw versions prior to 0.15.4

Description The issue allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a divide-by-zero, infinite loop, or NULL pointer dereference. Multiple vulnerabilities in the libraw package can lead to violations of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be carried out remotely.

Recommendations For dcraw versions 0.8.x through 0.8.9, update to a version later than 0.8.9 to resolve the issue. For libraw versions prior to 0.15.4, update to version 0.15.4 or later to fix the vulnerabilities.

Fix

Related Identifiers

BDU:2015-09729

CVE-2013-1438

DSA-2748-1

MGASA-2013-0301

MGASA-2013-0385

MGASA-2014-0011

MGASA-2014-0050

MGASA-2014-0071

MGASA-2014-0081

USN-1964-1

USN-1978-1

Affected Products

Dcraw

Libraw

References · 42

• https://advisories.mageia.org/MGASA-2014-0050.html · Security Note
• https://advisories.mageia.org/MGASA-2014-0071.html · Security Note
• https://bdu.fstec.ru/vul/2015-09729 · Security Note
• https://osv.dev/vulnerability/MGASA-2013-0385 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2013-December/124176.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-1438 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-1438 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0385.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1438 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0071 · Vendor Advisory
• http://debian.org/security/2013/dsa-2748 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-1438 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0301 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1438 · Security Note