PT-2018-3825 · Libraw+3 · Libraw+3

Alexutubalin · Published 2018-04-24 · Updated 2022-01-29 · CVE-2018-5812

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.18.9

Description The issue is related to errors in pointer dereferencing within the nikon coolscan load raw() function in the internal/dcraw common.cpp component of the LibRaw image processing library. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 0.18.9, update to version 0.18.9 or later to resolve the issue. As a temporary workaround, consider disabling the nikon coolscan load raw() function until a patch is available.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-1695

BDU:2022-05866

CVE-2018-5812

DLA-2903-1

OPENSUSE-SU-2018_2286-1

USN-3838-1

Affected Products

Alt Linux

Libraw

Suse

Ubuntu

References · 24

• https://github.com/LibRaw/LibRaw/commit/fd6330292501983ac75fe4162275794b18445bd9 · Patch
• https://ubuntu.com/security/CVE-2018-5807 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05866 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-5812 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5811 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3838-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-5812 · Vendor Advisory
• https://usn.ubuntu.com/3838-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-5812 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5815 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5812 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5812 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5810 · Vendor Advisory