Red Hat Security AdvisoryRHSA-2018:3065
libkdcraw security update
Released 2018-10-30 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libkdcraw-4.10.5-5.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libkdcraw-devel-4.10.5-5.el7
- Red Hat Enterprise Linux Server (v. 7) libkdcraw-4.10.5-5.el7, libkdcraw-devel-4.10.5-5.el7
- Red Hat Enterprise Linux Workstation (v. 7) libkdcraw-4.10.5-5.el7, libkdcraw-devel-4.10.5-5.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) libkdcraw-4.10.5-5.el7, libkdcraw-devel-4.10.5-5.el7
Fixes 5 records
Priority MEDIUM 42
A boundary error within the "quicktake_100_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a crash.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01984 · Published 2018-12-07 · Partial fix · 0.18.8 CWE-787
Priority MEDIUM 42
An error within the "kodak_radc_load_raw()" function (internal/dcraw_common.cpp) related to the "buf" variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access and subseque…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01974 · Published 2018-12-07 · Partial fix · 0.18.7 CWE-125
Priority LOW 34
An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently cause a cras…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02548 · Published 2018-12-07 · Partial fix · 0.18.7 CWE-193
Priority LOW 33
An error within the "LibRaw::unpack()" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02039 · Published 2018-12-07 · Partial fix · 0.18.7 CWE-476
Priority LOW 32
An error within the "leaf_hdr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a NULL pointer dereference.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01689 · Published 2018-12-07 · Partial fix · 0.18.8 CWE-476
THREATIST.IORead the docs