CVE-2017-6886 - libraw: Memory corruption in the parse_tiff_ifd()

CRITICAL

libraw: Memory corruption in the parse_tiff_ifd()

Published May 16, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 3.36%

An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt memory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
0.x prior to 0.18.2	affected	-

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	LibRaw	Will not fix	n/a

No remediation recorded yet.

Weaknesses (1)

CWE-119

Buffer Overflow

Link	Providers	Tags
http://www.debian.org/security/2017/dsa-3950		vendor-advisoryx_refsource_DEBIAN
http://www.securityfocus.com/bid/98605		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-6886		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1451640		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-15940		Advisory
https://github.com/LibRaw/LibRaw/commit/d7c3d2cb460be10a3ea7b32e9443a83c243b2251		x_refsource_CONFIRMPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-6886
https://secuniaresearch.flexerasoftware.com/advisories/75737/		x_refsource_MISCPermissions RequiredThird Party Advisory
https://secuniaresearch.flexerasoftware.com/secunia_research/2017-5/		x_refsource_MISCPermissions RequiredThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-6886