PT-2018-15011 · Dave Coffin+3 · Dcraw+3

Hanno Böck · Published 2018-06-06 · Updated 2022-05-19 · CVE-2018-19567

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions dcraw versions through 9.28

Description A floating point exception in the parse tiff ifd function could be used by attackers to crash an application that bundles the dcraw code by supplying malicious files.

Recommendations For dcraw versions through 9.28, consider updating to a version that fixes the issue in the parse tiff ifd function to prevent application crashes due to malicious files.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-1857

CVE-2018-19567

MGASA-2022-0160

OPENSUSE-SU-2022_1277-1

SUSE-SU-2022:1277-1

SUSE-SU-2022:1749-1

Affected Products

Alt Linux

Debian

Suse

Dcraw

References · 40

• https://ubuntu.com/security/CVE-2018-19567 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-19567 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0160.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-19567 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-19567 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:1277-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19567 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19567 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19567 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1749-1 · Vendor Advisory
• https://bugzilla.suse.com/1084690 · Note
• https://suse.com/security/cve/CVE-2018-5806 · Note
• https://suse.com/security/cve/CVE-2018-5801 · Note
• https://suse.com/security/cve/CVE-2018-19655 · Note