Bug 1610479 (CVE-2018-5810) - CVE-2018-5810 libRaw: heap-based buffer overflow in rollei_load_raw in internal/dcraw_common.cpp
Summary: CVE-2018-5810 libRaw: heap-based buffer overflow in rollei_load_raw in intern...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-5810
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1543597 1610480 1613945 1826586
Blocks: 1610488
TreeView+ depends on / blocked
 
Reported: 2018-07-31 17:34 UTC by Laura Pardo
Modified: 2020-04-22 04:32 UTC (History)
6 users (show)

Fixed In Version: LibRaw 0.18.9
Clone Of:
Environment:
Last Closed: 2020-04-22 04:32:01 UTC
Embargoed:

Attachments (Terms of Use)

Description Laura Pardo 2018-07-31 17:34:14 UTC 
A flaw was found in LibRaw versions before 0.18.9. An error within the rollei_load_raw() function (internal/dcraw_common.cpp) can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.


References:
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-10/
Comment 1 Laura Pardo 2018-07-31 17:35:43 UTC 
Created LibRaw tracking bugs for this issue:

Affects: epel-6 [bug 1610480]
Comment 2 Riccardo Schirone 2018-08-08 08:46:24 UTC 
Upstream patch:
https://github.com/LibRaw/LibRaw/commit/c9d8143eba4ff397163665e2119c6c5d7db54c55
Comment 3 Riccardo Schirone 2018-08-08 15:05:58 UTC 
Function rollei_load_raw() does not check whether the index used to access the raw_image array is in bounds, thus a crafted raw image could cause a heap-based buffer overflow, which could result in a crash or in other unspecified effects.
Comment 6 Debarshi Ray 2018-11-22 16:34:14 UTC 
This was fixed in LibRaw-0.18.9 and LibRaw-0.19.0-Beta3.
Comment 8 Doran Moppert 2020-04-22 03:31:26 UTC 
Created LibRaw tracking bugs for this issue:

Affects: epel-6 [bug 1826586]
Comment 9 Product Security DevOps Team 2020-04-22 04:32:01 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-5810
Note You need to log in before you can comment on or make changes to this bug.