Description
A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 13 | | | 0.18.2-2 |
 alpine v3.3 | | =0.12.3-r0 || =0.13.2-r0 || =0.13.5-r0 || =0.13.5-r1 || =0.13.6-r0 || =0.13.7-r0 || =0.13.8-r0 || =0.14.3-r0 || =0.14.4-r0 || =0.14.5-r0 || =0.14.6-r0 || =0.14.7-r0 || =0.15.2-r0 || =0.15.2-r1 || =0.15.4-r0 || =0.16.0-r0 || =0.16.1-r0 || =0.16.2-r0 || =0.17.0-r0 || =0.17.1-r0 || =0.17.2-r0 || >=0 <0.17.2-r1 | 0.17.2-r1 |
alpine v3.5 | | =0.12.3-r0 || =0.13.2-r0 || =0.13.5-r0 || =0.13.5-r1 || =0.13.6-r0 || =0.13.7-r0 || =0.13.8-r0 || =0.14.3-r0 || =0.14.4-r0 || =0.14.5-r0 || =0.14.6-r0 || =0.14.7-r0 || =0.15.2-r0 || =0.15.2-r1 || =0.15.4-r0 || =0.16.0-r0 || =0.16.1-r0 || =0.16.2-r0 || =0.17.0-r0 || =0.17.1-r0 || =0.17.2-r0 || >=0 <0.17.2-r1 | 0.17.2-r1 |
alpine v3.6 | | =0.12.3-r0 || =0.13.2-r0 || =0.13.5-r0 || =0.13.5-r1 || =0.13.6-r0 || =0.13.7-r0 || =0.13.8-r0 || =0.14.3-r0 || =0.14.4-r0 || =0.14.5-r0 || =0.14.6-r0 || =0.14.7-r0 || =0.15.2-r0 || =0.15.2-r1 || =0.15.4-r0 || =0.16.0-r0 || =0.16.1-r0 || =0.16.2-r0 || =0.17.0-r0 || =0.17.1-r0 || =0.17.2-r0 || >=0 <0.17.2-r1 | 0.17.2-r1 |
debian 12 | | | 0.18.2-2 |
debian 11 | | | 0.18.2-2 |
debian 14 | | | 0.18.2-2 |
alpine v3.4 | | =0.12.3-r0 || =0.13.2-r0 || =0.13.5-r0 || =0.13.5-r1 || =0.13.6-r0 || =0.13.7-r0 || =0.13.8-r0 || =0.14.3-r0 || =0.14.4-r0 || =0.14.5-r0 || =0.14.6-r0 || =0.14.7-r0 || =0.15.2-r0 || =0.15.2-r1 || =0.15.4-r0 || =0.16.0-r0 || =0.16.1-r0 || =0.16.2-r0 || =0.17.0-r0 || =0.17.1-r0 || =0.17.2-r0 || >=0 <0.17.2-r1 | 0.17.2-r1 |
 rpm rhel7 | | - | - |
