LibRaw versions prior to 0.18.12 are vulnerable to an integer overflow in the internal/dcraw_common.cpp:identify() function. An attacker could exploit this to cause an divide-by-zero and resultant denial of service via a specially crafted NOKIARAW file. This vulnerability was caused by an incomplete fix to CVE-2018-5804. Reference: http://seclists.org/bugtraq/2018/Jul/58
Created LibRaw tracking bugs for this issue: Affects: epel-6 [bug 1610159] Affects: fedora-all [bug 1610157] Created mingw-LibRaw tracking bugs for this issue: Affects: fedora-all [bug 1610158]
This looks like the patch: https://github.com/LibRaw/LibRaw/commit/4a3e68a41cf6d67fd83cffd2651d97d75dffcb57
I believed this was introduced via https://github.com/LibRaw/LibRaw/commit/d5715aa86a83c756e38fdbae0e034e5a07901d49 This is not in RHEL7.
Statement: This issue did not affect the versions of LibRaw as shipped with Red Hat Enterprise Linux 7.
This was fixed in LibRaw 0.19.0-Beta6 and 0.18.12.