Some memory corruption bugs were discovered in libraw, a raw image decoder library, which could be triggered via maliciously crafted input files to cause denial of service or other unspecified impact.

For Debian 7 'Wheezy', these problems have been fixed in version 0.14.6-2+deb7u2.

We recommend that you upgrade your libraw packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 0.18.2, see https://www.libraw.org/news/libraw-0-18-2 for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libraw fixes the following issues :

  - CVE-2017-6890: A boundary error within the     'foveon_load_camf()' function was fixed. [boo#1039209]

  - CVE-2017-6889: An integer overflow error within the     'foveon_load_camf()' function was fixed. [boo#1039210]

  - CVE-2017-6887: A memory corruption via e.g. a specially     crafted KDC file parse_tiff_ifd() was fixed.
    [boo#1039379]

  - CVE-2017-6886: A memory corruption in parse_tiff_ifd()     function was fixed. [boo#1039380]

This update for libraw fixes the following issues :

  - CVE-2015-3885: A specially crafted raw image file could     have caused a Denial of Service through an integer     overflow. (bsc#930683)

  - CVE-2015-8367: The function phase_one_correct() did not     handle memory object initialization correctly, which may     have caused some other problems. (bsc#957517)

  - CVE-2017-6886: memory corruption in parse_tiff_ifd()     func (internal/dcraw_common.cpp) could lead to Denial of     service (bsc#1039380)

  - CVE-2017-6889: integer overflow error within the     'foveon_load_camf()' function (dcraw_foveon.c) could     lead to Denial of service (bsc#1039210)

  - CVE-2017-6890: boundary error within the     'foveon_load_camf()' function (dcraw_foveon.c)     (bsc#1039209)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libraw: Memory corruption in the parse_tiff_ifd() (CVE-2017-6886)

  - A boundary error within the parse_tiff_ifd() function (internal/dcraw_common.cpp) in LibRaw versions     before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with     model set to DSLR-A100 and containing multiple sequences of 0x100 and 0x14A TAGs. (CVE-2017-6887)

  - An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function     in libraw_cxx.cpp. (CVE-2018-10528)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

Hossein Lotfi and Jakub Jirasek from Secunia Research have discovered multiple vulnerabilities in LibRaw, a library for reading RAW images.
An attacker could cause a memory corruption leading to a DoS (Denial of Service) with craft KDC or TIFF file.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3492-1 advisory.

    It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked     into processing a specially crafted photo file, a remote attacker could cause applications linked against     LibRaw to crash, resulting in a denial of service, or possibly execute arbitrary code

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
102481	Debian DLA-1057-1 : libraw security update	Nessus	Debian Local Security Checks	8/15/2017	1/11/2021	critical
101714	Fedora 26 : mingw-LibRaw (2017-bce18ed3f2)	Nessus	Fedora Local Security Checks	7/17/2017	1/6/2021	critical
100567	openSUSE Security Update : libraw (openSUSE-2017-640)	Nessus	SuSE Local Security Checks	6/1/2017	1/19/2021	critical
102855	SUSE SLED12 Security Update : libraw (SUSE-SU-2017:2300-1)	Nessus	SuSE Local Security Checks	8/31/2017	1/6/2021	critical
199041	RHEL 7 : libraw (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
195750	RHEL 7 : libraw (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	critical
102630	Debian DSA-3950-1 : libraw - security update	Nessus	Debian Local Security Checks	8/22/2017	1/4/2021	critical
104785	Ubuntu 14.04 LTS / 16.04 LTS : LibRaw vulnerabilities (USN-3492-1)	Nessus	Ubuntu Local Security Checks	11/27/2017	8/27/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical