PT-2017-17398 · Libraw+1 · Libraw-Demosaic-Pack-Gpl2+1

Published 2017-05-15 · Updated 2024-06-15 · CVE-2017-6890

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibRaw-demosaic-pack-GPL2 versions prior to 0.18.2

Description A boundary error in the foveon load camf() function, located in dcraw foveon.c, can cause a stack-based buffer overflow when initializing a huffman table.

Recommendations For versions prior to 0.18.2, update to version 0.18.2 or later to resolve the issue. As a temporary workaround, consider disabling the foveon load camf() function until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-6890

MGASA-2017-0223

OPENSUSE-SU-2024:10980-1

SUSE-SU-2017:2300-1

Affected Products

Libraw-Demosaic-Pack-Gpl2

Suse

References · 34

• https://github.com/LibRaw/LibRaw-demosaic-pack-GPL2/commit/194f592e205990ea8fce72b6c571c14350aca716 · Patch
• https://advisories.mageia.org/MGASA-2017-0223.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-6890 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0223 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6890 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2300-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10980-1 · Vendor Advisory
• https://bugzilla.suse.com/930683 · Note
• https://suse.com/security/cve/CVE-2017-6899 · Note
• https://suse.com/security/cve/CVE-2015-3885 · Note
• https://bugs.mageia.org/show_bug.cgi?id=21004 · Note
• https://suse.com/security/cve/CVE-2017-6889 · Note
• https://suse.com/security/cve/CVE-2018-5819 · Note
• https://lists.opensuse.org/opensuse-updates/2017-05/msg00111.html · Note
• https://suse.com/security/cve/CVE-2015-8367 · Note