PT-2017-17396 · Libraw+3 · Libraw+3

Alextutubalin · Published 2017-03-13 · Updated 2024-06-15 · CVE-2017-6887

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.18.2

Description A boundary error within the parse tiff ifd() function can be exploited to cause memory corruption via a specially crafted file, such as a KDC file with the model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.

Recommendations For versions prior to 0.18.2, update to version 0.18.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the parse tiff ifd() function until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2017-1273

CVE-2017-6887

DLA-1057-1

DSA-3950-1

MGASA-2017-0223

OPENSUSE-SU-2024:10980-1

SUSE-SU-2017:2300-1

USN-3492-1

Affected Products

Alt Linux

Libraw

Suse

Ubuntu

References · 55

• https://github.com/LibRaw/LibRaw/commit/d7c3d2cb460be10a3ea7b32e9443a83c243b2251 · Patch
• https://osv.dev/vulnerability/MGASA-2017-0223 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6887 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-6887 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3950-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8366 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6887 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3885 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3492-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2300-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6887 · Security Note
• https://ubuntu.com/security/CVE-2015-8367 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0223.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-6887 · Security Note
• https://ubuntu.com/security/CVE-2017-14348 · Vendor Advisory