Bug 1553334 – CVE-2018-5801 LibRaw: NULL pointer dereference in LibRaw::unpack function src/libraw_cxx.cpp

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1553334 - (CVE-2018-5801) CVE-2018-5801 LibRaw: NULL pointer dereference in LibRaw::unpack function src/libraw_cxx.cpp

Summary:	CVE-2018-5801 LibRaw: NULL pointer dereference in LibRaw::unpack function src...

Status:	NEW

Aliases:	CVE-2018-5801

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180130,reported=2...
Keywords:	Security

Depends On:	1557161 1557162 1557165 1557170 1557172 1557173 1557157 1557158 1557159 1557160 1557163 1557171
Blocks:	1553339
	Show dependency tree / graph

Reported:	2018-03-08 12:14 EST by Pedro Sampaio
Modified:	2018-10-30 03:29 EDT (History)
CC List:	15 users (show)

See Also:
Fixed In Version:	LibRaw 0.18.7
Doc Type:	If docs needed, set a value
Doc Text:	A NULL pointer dereference flaw was found in the way LibRaw processed images. An attacker could potentially use this flaw to crash applications using LibRaw by tricking them into processing crafted images.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2018:3065	None	None	None	2018-10-30 03:29 EDT

Groups: None (edit)

Description Pedro Sampaio 2018-03-08 12:14:05 EST

An error within the "LibRaw::unpack()" function (src/libraw_cxx.cpp) can be exploited to trigger a NULL pointer dereference.

External References:

https://packetstormsecurity.com/files/146172/secunia-libraw.txt

Upstream Patch:

https://github.com/LibRaw/LibRaw/commit/8682ad204392b91

Comment 3 Dhiru Kholia 2018-03-16 02:38:15 EDT

Created mingw-LibRaw tracking bugs for this issue:

Affects: fedora-all [bug 1557159]


Created dcraw tracking bugs for this issue:

Affects: fedora-all [bug 1557160]


Created LibRaw tracking bugs for this issue:

Affects: fedora-all [bug 1557157]


Created rawtherapee tracking bugs for this issue:

Affects: fedora-all [bug 1557163]


Created libkdcraw tracking bugs for this issue:

Affects: fedora-all [bug 1557161]


Created LibRaw tracking bugs for this issue:

Affects: epel-6 [bug 1557162]

Comment 7 Debarshi Ray 2018-09-27 09:49:44 EDT

This was fixed in LibRaw-0.18.7. The commit message has 7 typoed as 17.

Comment 8 errata-xmlrpc 2018-10-30 03:29:04 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3065 https://access.redhat.com/errata/RHSA-2018:3065

Note You need to log in before you can comment on or make changes to this bug.