Denial of service in libraw

Published: 2017-12-12

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2017-16909 CVE-2017-16910
CWE-ID	CWE-122 CWE-125
Exploitation vector	Local
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	LibRaw Universal components / Libraries / Libraries used by multiple products
Vendor	LibRaw LLC

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU11799

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-16909

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists due to incorrect handling of photo files. A local attacker can send specially crafted files, trigger heap-buffer overflow in the LibRaw::panasonic_load_raw() function and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

LibRaw: 0.8.15

External links

http://bugzilla.redhat.com/show_bug.cgi?id=1524859

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Out-of-bounds read

EUVDB-ID: #VU11800