Описание
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (line 856). The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that 2 bytes remain in the buffer. The standard ptp_unpack_DPD() at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.
A flaw was found in libgphoto2, a library for camera access and control. An out-of-bounds read vulnerability exists in the ptp_unpack_Sony_DPD() function. This occurs when the function attempts to read a 2-byte enumeration count without first verifying that sufficient data remains in the buffer. A local attacker or a malicious device connected to the system could exploit this to potentially disclose sensitive information from memory or cause a denial of service.
Меры по смягчению последствий
To mitigate this issue, restrict physical access to systems running libgphoto2 and avoid connecting untrusted or malicious devices. This operational control limits the attack surface by preventing the necessary physical interaction or device connection required for exploitation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | libgphoto2 | Fix deferred | ||
| Red Hat Enterprise Linux 6 | libgphoto2 | Fix deferred | ||
| Red Hat Enterprise Linux 7 | libgphoto2 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | libgphoto2 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | libgphoto2 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.
libgphoto2 is a camera access and control library. Versions up to and ...
EPSS
6.1 Medium
CVSS3