In LibRaw before 0.21.4, tag 0x412 processing in phaseonecorrect in decoders/loadmfbacks.cpp does not enforce minimum w0 and w1 values.
A Stack-based Buffer Overflow was discovered in xtransinterpolate in internal/dcrawcommon.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.
An error within the "parsetiffifd()" function (internal/dcrawcommon.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt memory.
An integer overflow error within the "foveonloadcamf()" function (dcrawfoveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
A boundary error within the "foveonloadcamf()" function (dcrawfoveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a stack-based buffer overflow.
Array index error in smaldecodesegment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes.
The phaseonecorrect function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related to memory object initialization.
In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp allows out-of-buffer access because splitcol and splitrow values are not checked in 0x041f tag processing.
In LibRaw before 0.21.4, phaseonecorrect in decoders/loadmfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations.
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
In LibRaw through 0.18.4, an out of bounds read flaw related to kodak65000loadraw has been reported in dcraw/dcraw.c and internal/dcrawcommon.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.
An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in librawx3f.cpp and librawcxx.cpp.
LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.
A boundary error within the "quicktake100loadraw()" function (internal/dcrawcommon.cpp) can be exploited to cause a stack-based buffer overflow and subsequently cause a crash.
References:
https://secuniaresearch.flexerasoftware.com/secuniaresearch/2018-03
A flaw was found in libraw. Stack buffer overflow in LibRaw::identifyprocessdngfields in identify.cpp may lead to local denial of service or local arbitrary code execution from a user crafted file.
References:
https://github.com/LibRaw/LibRaw/commit/4feaed4dea636cee4fee010f615881ccf76a096d https://github.com/LibRaw/LibRaw/issues/330
An error within the "findgreen()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.
An error within the "LibRaw::parseexif()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.
A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalizemodel.cpp may lead to context-dependent arbitrary code execution.
A boundary error within the "parsetiffifd()" function (internal/dcrawcommon.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRawbufferdatastream::gets(char, int) in /src/libraw/src/librawdatastream.cpp.
Multiple double free vulnerabilities in the LibRaw::unpack function in librawcxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.
Buffer overflow in the exposure correction code in LibRaw before 0.15.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
There is a floating point exception in the kodakradcloadraw function in dcrawcommon.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack.
Last updated 24 July 2024
An integer overflow error within the "parseqt()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.12 can be exploited to trigger an infinite loop via a specially crafted Apple QuickTime file.
LibRaw before 0.20-Beta3 has an out-of-bounds write in parseexif() in metadata\exifgps.cpp via an unrecognized AtomName and a zero value of tiffnifds.
An error within the "leafhdrloadraw()" function (internal/dcrawcommon.cpp) can be exploited to trigger a NULL pointer dereference.
References:
https://secuniaresearch.flexerasoftware.com/secuniaresearch/2018-03
A type confusion error within the "identify()" function (internal/dcrawcommon.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a division by zero.
A flaw was found in LibRaw. A heap-buffer-overflow in raw2imageex() caused by a maliciously crafted file may lead to an application crash.
Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\src\postprocessing\aspectratio.cpp.