Описание
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (line 842). The function reads the FormFlag byte via dtoh8o(data, *poffset) without a prior bounds check. The standard ptp_unpack_DPD() at lines 686–687 correctly validates *offset + sizeof(uint8_t) > dpdlen before this same read, but the Sony variant omits this check entirely. Commit 09f8a940b1e418b5693f5c11e3016a1ad2cea62d fixes the issue.
A flaw was found in libgphoto2, a library for camera access and control. An out-of-bounds read vulnerability exists in the ptp_unpack_Sony_DPD() function due to a missing bounds check when reading the FormFlag byte. This flaw could allow an attacker to disclose sensitive information from memory.
Меры по смягчению последствий
If camera interaction is not required, remove the libgphoto2 package to eliminate this vulnerability. Alternatively, avoid connecting untrusted cameras or processing untrusted image data through applications that utilize libgphoto2. This operational control reduces exposure by limiting the attack surface.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | libgphoto2 | Fix deferred | ||
| Red Hat Enterprise Linux 6 | libgphoto2 | Fix deferred | ||
| Red Hat Enterprise Linux 7 | libgphoto2 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | libgphoto2 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | libgphoto2 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5 Medium
CVSS3
Связанные уязвимости
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 842). The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without a prior bounds check. The standard `ptp_unpack_DPD()` at lines 686–687 correctly validates `*offset + sizeof(uint8_t) > dpdlen` before this same read, but the Sony variant omits this check entirely. Commit 09f8a940b1e418b5693f5c11e3016a1ad2cea62d fixes the issue.
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 842). The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without a prior bounds check. The standard `ptp_unpack_DPD()` at lines 686–687 correctly validates `*offset + sizeof(uint8_t) > dpdlen` before this same read, but the Sony variant omits this check entirely. Commit 09f8a940b1e418b5693f5c11e3016a1ad2cea62d fixes the issue.
libgphoto2 is a camera access and control library. Versions up to and ...
EPSS
5 Medium
CVSS3