PT-2019-4977 · Libraw+3 · Libraw+3

Published 2018-11-23 · Updated 2022-01-29 · CVE-2018-5817

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibRaw versions prior to 0.19.1

Description A type confusion error within the unpacked load raw() function can be exploited to trigger an infinite loop, potentially leading to a denial of service. This issue is related to errors in type conversion.

Recommendations For versions prior to 0.19.1, update to version 0.19.1 or later to resolve the issue. As a temporary workaround, consider disabling the unpacked load raw() function until a patch is available.

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

ALT-PU-2018-2684

BDU:2020-01600

CVE-2018-5817

DLA-1734-1

DLA-2903-1

OPENSUSE-SU-2019:0094-1

OPENSUSE-SU-2019_0094-1

SUSE-SU-2019:0127-1

SUSE-SU-2019:0133-1

USN-3989-1

Affected Products

Alt Linux

Libraw

Suse

Ubuntu

References · 114

• https://bdu.fstec.ru/vul/2022-05954 · Security Note
• https://bdu.fstec.ru/vul/2022-05958 · Security Note
• https://bdu.fstec.ru/vul/2020-01601 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5817 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5806 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5805 · Security Note
• https://bdu.fstec.ru/vul/2022-05866 · Security Note
• https://osv.dev/vulnerability/USN-3989-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07799 · Security Note
• https://usn.ubuntu.com/3989-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02106 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5818 · Security Note
• https://libraw.org/news/libraw-0-19-2-release · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5817 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05865 · Security Note