SB2018073125 - Fedora 28 update for mingw-LibRaw
Published: July 31, 2018 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Infinite loop (CVE-ID: CVE-2018-5815)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to integer overflow condition in the parse_qt()function, as defined in the internal/dcraw_common.cpp source code file in LibRaw versions prior to 0.18.12. A remote attacker can trick the victim into processing a specially crafted Apple QuickTime file, trigger an infinite loop condition and cause the service to crash.
2) Infinite loop (CVE-ID: CVE-2018-5816)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to a divide by zero integer overflow condition in the identify() function, as defined in the internal/dcraw_common.cpp source code file in LibRaw versions prior to 0.18.12. A remote attacker can trick the victim into processing a specially crafted NOKIARAW file, trigger an infinite loop condition and cause the service to crash.
Remediation
Install update from vendor's website.