In LibRaw before 0.21.4, tag 0x412 processing in phaseonecorrect in decoders/loadmfbacks.cpp does not enforce minimum w0 and w1 values.

An integer overflow vulnerability exists in the uncompressedfpdngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

A heap-based buffer overflow vulnerability exists in the x3floadhuffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

An integer overflow vulnerability exists in the deflatedngloadraw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

A heap-based buffer overflow vulnerability exists in the losslessjpegloadraw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

A heap-based buffer overflow vulnerability exists in the x3fthumbloader functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

A Stack-based Buffer Overflow was discovered in xtransinterpolate in internal/dcrawcommon.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.

An error within the "parsetiffifd()" function (internal/dcrawcommon.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt memory.

In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp allows out-of-buffer access because splitcol and splitrow values are not checked in 0x041f tag processing.

In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.

In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.

An error within the "kodakradcloadraw()" function (internal/dcrawcommon.cpp) related to the "buf" variable can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.

External References:

https://packetstormsecurity.com/files/146172/secunia-libraw.txt

Upstream Patch:

https://github.com/LibRaw/LibRaw/commit/8682ad204392b91

An error within the "rolleiloadraw()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash.

An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function in librawcxx.cpp.

An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in librawx3f.cpp and librawcxx.cpp.

A flaw was found in LibRaw 0.19.1. A stack-based buffer overflow in the parsemakernote function of dcrawcommon.cpp. Crafted input will lead to a denial of service.

References: https://github.com/LibRaw/LibRaw/issues/192

Upstream Patch: https://github.com/LibRaw/LibRaw/commit/fbf60377c006eaea8d3eca3f5e4c654909dcdfd2

An error related to the "LibRaw::panasonicloadraw()" function (dcrawcommon.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image.

A flaw was found in libraw. Stack buffer overflow in LibRaw::identifyprocessdngfields in identify.cpp may lead to local denial of service or local arbitrary code execution from a user crafted file.

References:

https://github.com/LibRaw/LibRaw/commit/4feaed4dea636cee4fee010f615881ccf76a096d https://github.com/LibRaw/LibRaw/issues/330

An error within the "samsungloadraw()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash.

Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRawbufferdatastream::gets(char, int) in /src/libraw/src/librawdatastream.cpp.

There is a floating point exception in the kodakradcloadraw function in dcrawcommon.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack.

Last updated 24 July 2024

A type confusion error within the "unpackedloadraw()" function within LibRaw versions prior to 0.19.1 (internal/dcrawcommon.cpp) can be exploited to trigger an infinite loop.

An error within the "parsesinaria()" function (internal/dcrawcommon.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.

An error within the "parserollei()" function (internal/dcrawcommon.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.

An error within the "parseminolta()" function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite loop via a specially crafted file.

An integer overflow error within the "identify()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.12 can be exploited to trigger a division by zero via specially crafted NOKIARAW file (Note: This vulnerability is caused due to an incomplete fix of CVE-2018-5804).

A heap-based buffer overflow vulnerability exists in the losslessjpegloadraw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

A heap-based buffer overflow vulnerability exists in the x3floadhuffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.