PT-2013-1244 · Libraw+1 · Libraw+1

Raphael Geissert · Published 2013-09-15 · Updated 2014-02-10 · CVE-2013-1439

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libraw versions 0.13.x through 0.15.3 libraw version 0.15.x before 0.15.4

Description The issue affects the "faster LJPEG decoder" in libraw, allowing context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file. This can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely.

Recommendations For libraw versions 0.13.x through 0.15.3, update to version 0.15.4 or later. For libraw version 0.15.x before 0.15.4, update to version 0.15.4 or later.

Exploit

Fix

Related Identifiers

ALT-PU-2014-1073

BDU:2015-09729

CVE-2013-1439

MGASA-2013-0301

MGASA-2013-0385

MGASA-2014-0050

USN-1964-1

USN-1978-1

Affected Products

Alt Linux

Libraw

References · 27

• 🔥 https://github.com/LibRaw/LibRaw/commit/11909cc59e712e09b508dda729b99aeaac2b29ad · Exploit
• 🔥 http://openwall.com/lists/oss-security/2013/08/29/3 · Exploit
• https://ubuntu.com/security/notices/USN-1978-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0050.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-1439 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1439 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-1439 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09729 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-1439 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1439 · Security Note
• https://advisories.mageia.org/MGASA-2013-0385.html · Security Note
• http://debian.org/security/2013/dsa-2748 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1439 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0301 · Vendor Advisory