A type confusion error within the "identify()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a division by zero.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2903 advisory.

  - In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in     dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose     potentially sensitive memory or cause an application crash. (CVE-2017-14608)

  - An error related to the LibRaw::panasonic_load_raw() function (dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via     a specially crafted TIFF image. (CVE-2017-16909)

  - An error within the LibRaw::xtrans_interpolate() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause an invalid read memory access and subsequently a Denial of     Service condition. (CVE-2017-16910)

  - LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20363)

  - LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20364)

  - LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. (CVE-2018-20365)

  - An off-by-one error within the LibRaw::kodak_ycbcr_load_raw() function (internal/dcraw_common.cpp) in     LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently     cause a crash. (CVE-2018-5800)

  - An error within the LibRaw::unpack() function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7     can be exploited to trigger a NULL pointer dereference. (CVE-2018-5801)

  - An error within the kodak_radc_load_raw() function (internal/dcraw_common.cpp) related to the buf     variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access     and subsequently cause a crash. (CVE-2018-5802)

  - A type confusion error within the identify() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.8 can be exploited to trigger a division by zero. (CVE-2018-5804)

  - A boundary error within the quicktake_100_load_raw() function (internal/dcraw_common.cpp) in LibRaw     versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a     crash. (CVE-2018-5805)

  - An error within the leaf_hdr_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806)

  - An error within the samsung_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.
    (CVE-2018-5807)

  - An error within the find_green() function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9     can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.
    (CVE-2018-5808)

  - An error within the rollei_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.
    (CVE-2018-5810)

  - An error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a     crash. (CVE-2018-5811)

  - An error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.9 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5812)

  - An error within the parse_minolta() function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be     exploited to trigger an infinite loop via a specially crafted file. (CVE-2018-5813)

  - An integer overflow error within the parse_qt() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.12 can be exploited to trigger an infinite loop via a specially crafted Apple QuickTime     file. (CVE-2018-5815)

  - A type confusion error within the unpacked_load_raw() function within LibRaw versions prior to 0.19.1     (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop. (CVE-2018-5817)

  - An error within the parse_rollei() function (internal/dcraw_common.cpp) within LibRaw versions prior to     0.19.1 can be exploited to trigger an infinite loop. (CVE-2018-5818)

  - An error within the parse_sinar_ia() function (internal/dcraw_common.cpp) within LibRaw versions prior     to 0.19.1 can be exploited to exhaust available CPU resources. (CVE-2018-5819)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libraw fixes the following issues :

The following security vulnerabilities were addressed :

  - CVE-2018-5813: Fixed an error within the     'parse_minolta()' function (dcraw/dcraw.c) that could be     exploited to trigger an infinite loop via a specially     crafted file. This could be exploited to cause a     DoS.(boo#1103200).

  - CVE-2018-5815: Fixed an integer overflow in the     internal/dcraw_common.cpp:parse_qt() function, that     could be exploited to cause an infinite loop via a     specially crafted Apple QuickTime file. (boo#1103206)

  - CVE-2018-5804,CVE-2018-5816: Fixed a type confusion     error in the identify function (bsc#1097975)

This update was imported from the SUSE:SLE-15:Update update project.

This update for libraw fixes the following issues :

Security issues fixed :

The following security vulnerabilities were addressed :

CVE-2018-5813: Fixed an error within the 'parse_minolta()' function (dcraw/dcraw.c) that could be exploited to trigger an infinite loop via a specially crafted file. This could be exploited to cause a DoS.(boo#1103200).

CVE-2018-5815: Fixed an integer overflow in the internal/dcraw_common.cpp:parse_qt() function, that could be exploited to cause an infinite loop via a specially crafted Apple QuickTime file. (boo#1103206)

CVE-2018-5804,CVE-2018-5816: Fixed a type confusion error in the identify function (bsc#1097975)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libraw fixes the following issues :

The following security vulnerabilities were addressed :

  - CVE-2018-5804: Fixed a type confusion error within the     identify function that could trigger a division by zero,     leading to a denial of service (Dos). (boo#1097975)

  - CVE-2018-5805: Fixed a boundary error within the     quicktake_100_load_raw function that could cause a     stack-based buffer overflow and subsequently trigger a     crash. (boo#1097973)

  - CVE-2018-5806: Fixed an error within the     leaf_hdr_load_raw function that could trigger a NULL     pointer deference, leading to a denial of service (DoS).
    (boo#1097974)

  - CVE-2018-5808: Fixed an error within the find_green     function that could cause a stack-based buffer overflow     and subsequently execute arbitrary code. (boo#1118894)

  - CVE-2018-5816: Fixed a type confusion error within the     identify function that could trigger a division by zero,     leading to a denial of service (DoS). (boo#1097975)

ID	Name	Product	Family	Severity
158247	Debian DLA-2903-1 : libraw - LTS security update	Nessus	Debian Local Security Checks	critical
121089	openSUSE Security Update : libraw (openSUSE-2019-8)	Nessus	SuSE Local Security Checks	medium
120984	SUSE SLED15 / SLES15 Security Update : libraw (SUSE-SU-2019:0005-1)	Nessus	SuSE Local Security Checks	medium
119949	openSUSE Security Update : libraw (openSUSE-2018-1619)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-5804

medium

Tenable Plugins

critical

medium

medium

high