PT-2018-3437 · Libraw+3 · Libraw+3

Published 2018-11-22 · Updated 2024-06-15 · CVE-2018-5819

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: LibRaw versions prior to 0.19.1

Description: The issue is related to the parse sinar ia() function in the LibRaw library, which is used for image processing. It is associated with an uncontrolled resource consumption. Exploitation of this issue may allow a remote attacker to cause a denial of service by exhausting available CPU resources.

Recommendations: For versions prior to 0.19.1, update to version 0.19.1 or later to resolve the issue. As a temporary workaround, consider disabling the parse sinar ia() function until a patch is available.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2018-2684

BDU:2020-01549

CVE-2018-5819

DLA-1734-1

DLA-2903-1

OPENSUSE-SU-2019:0094-1

OPENSUSE-SU-2019_0094-1

OPENSUSE-SU-2024:10980-1

SUSE-SU-2019:0127-1

SUSE-SU-2019:0133-1

USN-3989-1

Affected Products

Alt Linux

Libraw

Suse

Ubuntu

References · 126

• https://bdu.fstec.ru/vul/2022-05954 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-5819 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05958 · Security Note
• https://bdu.fstec.ru/vul/2020-01601 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5817 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5806 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5805 · Security Note
• https://bdu.fstec.ru/vul/2022-05866 · Security Note
• https://osv.dev/vulnerability/USN-3989-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5819 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07799 · Security Note
• https://usn.ubuntu.com/3989-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02106 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5818 · Security Note
• https://libraw.org/news/libraw-0-19-2-release · Vendor Advisory