PT-2018-17159 · Libraw+3 · Libraw+3

Published 2018-06-12 · Updated 2019-03-23 · CVE-2018-5816

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: LibRaw versions prior to 0.18.12

Description: The issue is caused by an integer overflow error within the identify() function in internal/dcraw common.cpp, which can be exploited to trigger a division by zero via specially crafted NOKIARAW files.

Recommendations: For versions prior to 0.18.12, update to version 0.18.12 or later to resolve the issue. As a temporary workaround, consider avoiding the use of specially crafted NOKIARAW files that could trigger the division by zero error. Restrict access to the identify() function in internal/dcraw common.cpp to minimize the risk of exploitation.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2018-1893

CVE-2018-5816

MGASA-2018-0356

OPENSUSE-SU-2018_4299-1

OPENSUSE-SU-2019:0008-1

OPENSUSE-SU-2019_0008-1

SUSE-SU-2019:0005-1

USN-3838-1

Affected Products

Alt Linux

Libraw

Suse

Ubuntu

References · 38

• https://github.com/LibRaw/LibRaw/commit/1d8d1b452e5dc74033ee9f846081a0efb616cc39 · Patch
• https://ubuntu.com/security/CVE-2018-5807 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/SAILUJLX73GTMC4BTJPFRXMDQIFLWFMV · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5811 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-5816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5812 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0356 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:0008-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0356.html · Security Note
• https://cve.org/CVERecord?id=CVE-2018-5816 · Security Note
• https://ubuntu.com/security/notices/USN-3838-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-5816 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5816 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5816 · Vendor Advisory
• https://usn.ubuntu.com/3838-1 · Vendor Advisory