CRITICAL
libraw: Out-of-bounds read in the kodak_65000_load_raw function
Published Sep 20, 2017
9.1
CRITICALCVSS 3.0
EPSS 2.10%
Description
In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.
Affected products
No data.
No data.
Red Hat Enterprise Linux 5
dcraw
Will not fix
Red Hat Enterprise Linux 6
dcraw
Will not fix
Red Hat Enterprise Linux 7
LibRaw
Will not fix
Red Hat Enterprise Linux 7
dcraw
Will not fix
Red Hat Enterprise Linux 7
libkdcraw
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | dcraw | Will not fix | n/a |
| Red Hat Enterprise Linux 6 | dcraw | Will not fix | n/a |
| Red Hat Enterprise Linux 7 | LibRaw | Will not fix | n/a |
| Red Hat Enterprise Linux 7 | dcraw | Will not fix | n/a |
| Red Hat Enterprise Linux 7 | libkdcraw | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (6)
- https://access.redhat.com/security/cve/CVE-2017-14608 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1499687 Issue Tracking
- https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21 x_refsource_CONFIRMPatchThird Party Advisory
- https://github.com/LibRaw/LibRaw/issues/101 x_refsource_CONFIRMIssue TrackingThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2017-14608
- https://www.cve.org/CVERecord?id=CVE-2017-14608
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2017-14608 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1499687 | Issue Tracking | |
| https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21 | x_refsource_CONFIRMPatchThird Party Advisory | |
| https://github.com/LibRaw/LibRaw/issues/101 | x_refsource_CONFIRMIssue TrackingThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2017-14608 | ||
| https://www.cve.org/CVERecord?id=CVE-2017-14608 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Sep 20, 2017
Updated Aug 5, 2024
Reserved Sep 20, 2017
Link CVE-2017-14608
CISA Vulnrichment
Updated n/a