CVE-2018-5817: Incorrect Type Cast
A type confusion error within the "unpackedloadraw()" function within LibRaw versions prior to 0.19.1 (internal/dcrawcommon.cpp) can be exploited to trigger an infinite loop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librawto a version that resolves this vulnerability.Fixed in 0.20.2-1+deb11u1Fixed in 0.20.2-1+deb11u2Fixed in 0.20.2-2.1+deb12u1Fixed in 0.21.4-2Fixed in 0.21.5b-1 - Upgrade
Upgrade
alpine/librawto a version that resolves this vulnerability.Fixed in 0.19.2-r0 - Upgrade
Upgrade
LibRawto a version that resolves this vulnerability.Fixed in 0.19.1
Event History
Frequently Asked Questions
What is CVE-2018-5817?
CVE-2018-5817 is a type confusion error within the unpacked_load_raw() function in LibRaw versions prior to 0.19.1 that can be exploited to trigger an infinite loop.
How can CVE-2018-5817 be exploited?
CVE-2018-5817 can be exploited by triggering a type confusion error within the unpacked_load_raw() function in LibRaw versions prior to 0.19.1.
What is the severity of CVE-2018-5817?
The severity of CVE-2018-5817 is high with a CVSS score of 7.5.
How do I fix CVE-2018-5817?
To fix CVE-2018-5817, you should update LibRaw to version 0.19.1 or later.
Where can I find more information about CVE-2018-5817?
You can find more information about CVE-2018-5817 at the following references: [1](https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html), [2](https://secuniaresearch.flexerasoftware.com/secunia_research/2018-27/), [3](https://usn.ubuntu.com/3989-1/).