Bug 1852093 (CVE-2020-15365)

Summary: CVE-2020-15365 LibRaw: out-of-bounds write in parse_exif function in metadata/exif_gps.cpp
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: debarshir, dingyichen, gwync, hobbes1069, jridky, manisandro, nphilipp, siddharth.kde, siddhesh, than
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: LibRaw 0.20-Beta3 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-03 01:27:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1852097, 1852098    
Bug Blocks: 1852094    

Description Guilherme de Almeida Suckevicz 2020-06-29 17:41:26 UTC 
LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds.

Reference:
https://github.com/LibRaw/LibRaw/issues/301

Upstream commit:
https://github.com/LibRaw/LibRaw/commit/55f0a0c08974b8b79ebfa7762b555a1704b25fb2
Comment 1 Guilherme de Almeida Suckevicz 2020-06-29 17:44:29 UTC 
Created LibRaw tracking bugs for this issue:

Affects: fedora-all [bug 1852097]
Comment 2 Guilherme de Almeida Suckevicz 2020-06-29 17:45:05 UTC 
Created mingw-LibRaw tracking bugs for this issue:

Affects: fedora-all [bug 1852098]
Comment 3 Todd Cullum 2020-07-02 23:11:26 UTC 
Statement:

Versions of LibRaw shipped with Red Hat Enterprise Linux 7 and 8 are not affected by this flaw because the vulnerable code was introduced in a newer version of LibRaw. CR3 support was not introduced until 0.20-RC1 and the older exif code does not have the same logic.
Comment 4 Product Security DevOps Team 2020-07-03 01:27:35 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-15365