PT-2017-4224 · Libraw+3 · Libraw+3

Published 2017-11-21 · Updated 2022-01-29 · CVE-2017-16909

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.18.6

Description The issue is related to the LibRaw::panasonic load raw() function in the dcraw common.cpp component of the LibRaw image processing library. It can be exploited to cause a heap-based buffer overflow, potentially leading to a crash or allowing a remote attacker to access confidential data, compromise its integrity, or cause a denial of service via a specially crafted TIFF image.

Recommendations For versions prior to 0.18.6, update to version 0.18.6 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the LibRaw::panasonic load raw() function until a patch is available. Restrict access to the dcraw common.cpp component to minimize the risk of exploitation. Avoid using specially crafted TIFF images with the affected library until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2017-2757

BDU:2022-06038

CVE-2017-16909

DLA-2903-1

SUSE-SU-2017:3392-1

USN-3615-1

Affected Products

Alt Linux

Libraw

Suse

Ubuntu

References · 31

• https://github.com/LibRaw/LibRaw/commit/f1394822a0152ceed77815eafa5cac4e8baab10a · Patch
• https://osv.dev/vulnerability/CVE-2017-16909 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:3392-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://usn.ubuntu.com/3615-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3615-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16909 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16909 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5802 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-16909 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16910 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5800 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5801 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06038 · Security Note
• https://ubuntu.com/security/notices/USN-3615-1 · Vendor Advisory