PT-2018-3832 · Libraw+3 · Libraw+3

Alextutubalin · Published 2018-05-10 · Updated 2024-06-15 · CVE-2018-5813

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.18.11

Description The issue is related to an error in the parse minolta() function within the dcraw/dcraw.c component of the LibRaw image processing library. This error can be exploited by a remote attacker using a specially crafted file to trigger an infinite loop, leading to a denial of service.

Recommendations For versions prior to 0.18.11, update to version 0.18.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of the parse minolta() function in the dcraw/dcraw.c component until a patch is available.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2018-1695

BDU:2022-05954

CVE-2018-5813

DLA-2903-1

OPENSUSE-SU-2018_2286-1

OPENSUSE-SU-2019:0008-1

OPENSUSE-SU-2019_0008-1

OPENSUSE-SU-2024:10980-1

SUSE-SU-2018:3343-1

SUSE-SU-2019:0005-1

USN-3838-1

Affected Products

Alt Linux

Libraw

Suse

Ubuntu

References · 57

• https://github.com/LibRaw/LibRaw/commit/e47384546b43d0fd536e933249047bc397a4d88b · Patch
• https://ubuntu.com/security/CVE-2018-5807 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5811 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5813 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-5813 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5813 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5813 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10980-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5812 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:0008-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3838-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-5813 · Security Note
• https://usn.ubuntu.com/3838-1 · Vendor Advisory