Bug 1553332 – CVE-2018-5800 LibRaw: Heap-based buffer overflow in LibRaw::kodak_ycbcr_load_raw function in internal/dcraw_common.cpp

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1553332 - (CVE-2018-5800) CVE-2018-5800 LibRaw: Heap-based buffer overflow in LibRaw::kodak_ycbcr_load_raw function in internal/dcraw_common.cpp

Summary:	CVE-2018-5800 LibRaw: Heap-based buffer overflow in LibRaw::kodak_ycbcr_load_...

Status:	NEW

Aliases:	CVE-2018-5800

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180130,reported=2...
Keywords:	Security

Depends On:	1557203 1557202 1558954
Blocks:	1553339
	Show dependency tree / graph

Reported:	2018-03-08 12:10 EST by Pedro Sampaio
Modified:	2018-10-30 03:28 EDT (History)
CC List:	15 users (show)

See Also:
Fixed In Version:	LibRaw 0.18.7
Doc Type:	If docs needed, set a value
Doc Text:	A heap-based out-of-bounds access flaw was found in the way LibRaw processed images. An attacker could potentially use this flaw to crash applications using LibRaw by tricking them into processing crafted images.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2018:3065	None	None	None	2018-10-30 03:28 EDT

Groups: None (edit)

Description Pedro Sampaio 2018-03-08 12:10:12 EST

An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.

External References:

https://packetstormsecurity.com/files/146172/secunia-libraw.txt

Upstream Patch:

https://github.com/LibRaw/LibRaw/commit/8682ad204392b91

Comment 9 Debarshi Ray 2018-09-27 09:42:11 EDT

This was fixed in LibRaw-0.18.7. The commit message has 7 typoed as 17.

Comment 10 errata-xmlrpc 2018-10-30 03:28:45 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3065 https://access.redhat.com/errata/RHSA-2018:3065

Note You need to log in before you can comment on or make changes to this bug.