An error within the "nikon_coolscan_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to trigger a NULL pointer dereference.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2903 advisory.

  - In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in     dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose     potentially sensitive memory or cause an application crash. (CVE-2017-14608)

  - An error related to the LibRaw::panasonic_load_raw() function (dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via     a specially crafted TIFF image. (CVE-2017-16909)

  - An error within the LibRaw::xtrans_interpolate() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.6 can be exploited to cause an invalid read memory access and subsequently a Denial of     Service condition. (CVE-2017-16910)

  - LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20363)

  - LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. (CVE-2018-20364)

  - LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. (CVE-2018-20365)

  - An off-by-one error within the LibRaw::kodak_ycbcr_load_raw() function (internal/dcraw_common.cpp) in     LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently     cause a crash. (CVE-2018-5800)

  - An error within the LibRaw::unpack() function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7     can be exploited to trigger a NULL pointer dereference. (CVE-2018-5801)

  - An error within the kodak_radc_load_raw() function (internal/dcraw_common.cpp) related to the buf     variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access     and subsequently cause a crash. (CVE-2018-5802)

  - A type confusion error within the identify() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.8 can be exploited to trigger a division by zero. (CVE-2018-5804)

  - A boundary error within the quicktake_100_load_raw() function (internal/dcraw_common.cpp) in LibRaw     versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a     crash. (CVE-2018-5805)

  - An error within the leaf_hdr_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806)

  - An error within the samsung_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.
    (CVE-2018-5807)

  - An error within the find_green() function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9     can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.
    (CVE-2018-5808)

  - An error within the rollei_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions prior to     0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.
    (CVE-2018-5810)

  - An error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a     crash. (CVE-2018-5811)

  - An error within the nikon_coolscan_load_raw() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.9 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5812)

  - An error within the parse_minolta() function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be     exploited to trigger an infinite loop via a specially crafted file. (CVE-2018-5813)

  - An integer overflow error within the parse_qt() function (internal/dcraw_common.cpp) in LibRaw versions     prior to 0.18.12 can be exploited to trigger an infinite loop via a specially crafted Apple QuickTime     file. (CVE-2018-5815)

  - A type confusion error within the unpacked_load_raw() function within LibRaw versions prior to 0.19.1     (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop. (CVE-2018-5817)

  - An error within the parse_rollei() function (internal/dcraw_common.cpp) within LibRaw versions prior to     0.19.1 can be exploited to trigger an infinite loop. (CVE-2018-5818)

  - An error within the parse_sinar_ia() function (internal/dcraw_common.cpp) within LibRaw versions prior     to 0.19.1 can be exploited to exhaust available CPU resources. (CVE-2018-5819)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3838-1 advisory.

    It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked     into processing a specially crafted photo file, a remote attacker could cause applications linked against     LibRaw to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libraw fixes the following issues :

The following security vulnerabilities were addressed :

  - CVE-2018-5813: Fixed an error within the     'parse_minolta()' function (dcraw/dcraw.c) that could be     exploited to trigger an infinite loop via a specially     crafted file. This could be exploited to cause a     DoS.(boo#1103200).

  - CVE-2018-5815: Fixed an integer overflow in the     internal/dcraw_common.cpp:parse_qt() function, that     could be exploited to cause an infinite loop via a     specially crafted Apple QuickTime file. (boo#1103206)

  - CVE-2018-5810: Fixed an error within the     rollei_load_raw() function (internal/dcraw_common.cpp)     that could be exploited to cause a heap-based buffer     overflow and subsequently cause a crash. (boo#1103353)

  - CVE-2018-5811: Fixed an error within the     nikon_coolscan_load_raw() function     (internal/dcraw_common.cpp) that could be exploited to     cause an out-of-bounds read memory access and     subsequently cause a crash. (boo#1103359)

  - CVE-2018-5812: Fixed another error within the     nikon_coolscan_load_raw() function     (internal/dcraw_common.cpp) that could be exploited to     trigger a NULL pointer dereference. (boo#1103360)

  - CVE-2018-5807: Fixed an error within the     samsung_load_raw() function (internal/dcraw_common.cpp)     that could be exploited to cause an out-of-bounds read     memory access and subsequently cause a crash.
    (boo#1103361)

ID	Name	Product	Family	Severity
158247	Debian DLA-2903-1 : libraw - LTS security update	Nessus	Debian Local Security Checks	critical
119459	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : LibRaw vulnerabilities (USN-3838-1)	Nessus	Ubuntu Local Security Checks	high
111630	openSUSE Security Update : libraw (openSUSE-2018-849)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-5812

medium

Tenable Plugins

critical

high

high