Infinite loop in LibRaw - CVE-2018-5813
Published: December 10, 2018
Vulnerability identifier: #VU16353
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5813
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition.
The vulnerability exists due to due to improper parsing of files by the parse_minolta() function, as defined in the dcraw.c source code file of the affected software. A remote attacker can send trick the victim into accessing a file that submits malicious input, trigger an infinite loop condition that causes the affected software to crash or become unresponsive.
Affected software
LibRaw
Arch Linux
Ubuntu
Opensuse
libraw9 (Ubuntu package)
libraw15 (Ubuntu package)
libraw16 (Ubuntu package)
Arch Linux
Ubuntu
Opensuse
libraw9 (Ubuntu package)
libraw15 (Ubuntu package)
libraw16 (Ubuntu package)
How to mitigate CVE-2018-5813
Update to version 0.18.11.
LibRaw - update to 0.8.11
libraw9 (Ubuntu package) - update to 0.15.4-1ubuntu0.3
libraw15 (Ubuntu package) - update to 0.17.1-1ubuntu0.4
libraw16 (Ubuntu package) - update to 0.18.8-1ubuntu0.2
libraw9 (Ubuntu package) - update to 0.15.4-1ubuntu0.3
libraw15 (Ubuntu package) - update to 0.17.1-1ubuntu0.4
libraw16 (Ubuntu package) - update to 0.18.8-1ubuntu0.2