Lucene search

K
freebsdFreeBSD6F0B0CBF-1274-11E8-8B5B-4CCC6ADDA413
HistoryJan 16, 2018 - 12:00 a.m.

libraw -- multiple DoS vulnerabilities

2018-01-1600:00:00
vuxml.freebsd.org
17

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.008

Percentile

81.7%

Secunia Research reports:

CVE-2018-5800: An off-by-one error within the “LibRaw::kodak_ycbcr_load_raw()”
function (internal/dcraw_common.cpp) can be exploited to cause a heap-based
buffer overflow and subsequently cause a crash.
CVE-2017-5801: An error within the “LibRaw::unpack()” function
(src/libraw_cxx.cpp) can be exploited to trigger a NULL pointer dereference.
CVE-2017-5802: An error within the “kodak_radc_load_raw()” function
(internal/dcraw_common.cpp) related to the “buf” variable can be exploited
to cause an out-of-bounds read memory access and subsequently cause a crash.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchlibraw< 0.18.7UNKNOWN

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.008

Percentile

81.7%