Описание
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
A stack buffer overflow vulnerability was found in LibRaw. This flaw allows a malicious user to send a crafted image that, when parsed by an application linked to LibRaw, leads to a denial of service or potential code execution.
Отчет
LibRaw is not supposed to be used in RHEL by network-facing applications, thus reducing the impact of this flaw.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | dcraw | Out of support scope | ||
| Red Hat Enterprise Linux 7 | dcraw | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libkdcraw | Out of support scope | ||
| Red Hat Enterprise Linux 7 | LibRaw | Not affected | ||
| Red Hat Enterprise Linux 8 | dcraw | Not affected | ||
| Red Hat Enterprise Linux 9 | dcraw | Not affected | ||
| Red Hat Enterprise Linux 9 | LibRaw | Not affected | ||
| Red Hat Enterprise Linux 8 | LibRaw | Fixed | RHSA-2021:4381 | 09.11.2021 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_ ...
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
Уязвимость функции LibRaw::identify_process_dng_fields компонента identify.cpp библиотеки для обработки изображений LibRaw, связанная с записью за границами буфера, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
EPSS
8.1 High
CVSS3