CVE-2017-14608
libraw: Out-of-bounds read in the kodak_65000_load_raw function
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Ubuntu (mittel), Red Hat (niedrig).
Beschreibung
In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | libraw | 0.18.5-1 |
| debian 12 | libraw | 0.18.5-1 |
| debian 13 | libraw | 0.18.5-1 |
| debian 14 | libraw | 0.18.5-1 |
| debian 7 | libraw | 0.14.6-2+deb7u3 |
| debian 9 | libraw | 0.17.2-6+deb9u2 |
| echo | libraw | 0.18.5-1 |
| rapidfort ubuntu 20.04 | exactimage | kein Fix angegeben |
| rapidfort ubuntu 22.04 | exactimage | kein Fix angegeben |
| rapidfort ubuntu 24.04 | exactimage | kein Fix angegeben |
| Red Hat | LibRaw, LibRaw-devel, LibRaw-static und 1 weitere | kein Fix angegeben |
| root.io debian 13 | rootio-libraw | 0.18.5-1 |
Alle 26 Einträge aus 23 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | libraw | 0.18.5-1 |
| debian 12 | libraw | 0.18.5-1 |
| debian 13 | libraw | 0.18.5-1 |
| debian 14 | libraw | 0.18.5-1 |
| debian 7 | libraw | 0.14.6-2+deb7u3 |
| debian 9 | libraw | 0.17.2-6+deb9u2 |
| echo | libraw | 0.18.5-1 |
| rapidfort ubuntu 20.04 | exactimage | kein Fix angegeben |
| rapidfort ubuntu 22.04 | exactimage | kein Fix angegeben |
| rapidfort ubuntu 24.04 | exactimage | kein Fix angegeben |
| Red Hat | LibRaw | kein Fix angegeben |
| Red Hat | LibRaw-devel | kein Fix angegeben |
| Red Hat | LibRaw-static | kein Fix angegeben |
| Red Hat | dcraw | kein Fix angegeben |
| root.io debian 13 | rootio-libraw | 0.18.5-1 |
| ubuntu 14.04 | libraw | 0.15.4-1ubuntu0.1 |
| ubuntu 16.04 | libraw | 0.17.1-1ubuntu0.1 |
| ubuntu 16.04-ESM | libraw | 0.17.1-1ubuntu0.1 |
| ubuntu 17.04 | libraw | 0.18.1-1ubuntu0.1 |
| ubuntu 17.10 | libraw | 0.18.2-2ubuntu0.1 |
| ubuntu 18.04-ESM | exactimage | kein Fix angegeben |
| ubuntu 20.04-ESM | exactimage | kein Fix angegeben |
| ubuntu 22.04 | exactimage | kein Fix angegeben |
| ubuntu 24.04 | exactimage | kein Fix angegeben |
| ubuntu 26.04 | exactimage | kein Fix angegeben |
| ubuntu 26.10 | exactimage | kein Fix angegeben |
Referenzen
- https://access.redhat.com/security/cve/CVE-2017-14608
- https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21
- https://github.com/LibRaw/LibRaw/issues/101
- https://nvd.nist.gov/vuln/detail/CVE-2017-14608
- https://ubuntu.com/security/notices/USN-3492-1
- https://www.cve.org/CVERecord?id=CVE-2017-14608