Security update for libraw SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3343-1 Final 1 1 2018-10-23T14:43:27Z current 2018-10-23T14:43:27Z 2018-10-23T14:43:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libraw This update for libraw fixes the following issues: Security issues fixed: - CVE-2018-5800: Fixed heap-based buffer overflow in LibRaw::kodak_ycbcr_load_raw function (bsc#1084691). - CVE-2018-5801: Fixed NULL pointer dereference in LibRaw::unpack function (bsc#1084690). - CVE-2018-5802: Fixed out-of-bounds read in kodak_radc_load_raw function (bsc#1084688). - CVE-2018-5813: Fixed infinite loop in the parse_minolta function (bsc#1103200) - CVE-2018-5810: Fixed a heap-based buffer overflow in rollei_load_raw (bsc#1103353) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-2402,SUSE-SLE-SDK-12-SP3-2018-2402,SUSE-SLE-WE-12-SP3-2018-2402 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183343-1/ Link for SUSE-SU-2018:3343-1 https://lists.suse.com/pipermail/sle-security-updates/2018-October/004772.html E-Mail link for SUSE-SU-2018:3343-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1084688 SUSE Bug 1084688 https://bugzilla.suse.com/1084690 SUSE Bug 1084690 https://bugzilla.suse.com/1084691 SUSE Bug 1084691 https://bugzilla.suse.com/1103200 SUSE Bug 1103200 https://bugzilla.suse.com/1103353 SUSE Bug 1103353 https://www.suse.com/security/cve/CVE-2018-5800/ SUSE CVE CVE-2018-5800 page https://www.suse.com/security/cve/CVE-2018-5801/ SUSE CVE CVE-2018-5801 page https://www.suse.com/security/cve/CVE-2018-5802/ SUSE CVE CVE-2018-5802 page https://www.suse.com/security/cve/CVE-2018-5810/ SUSE CVE CVE-2018-5810 page https://www.suse.com/security/cve/CVE-2018-5813/ SUSE CVE CVE-2018-5813 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Workstation Extension 12 SP3 libraw9-0.15.4-21.1 libraw-devel-0.15.4-21.1 libraw-devel-static-0.15.4-21.1 libraw9-0.15.4-21.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libraw-devel-0.15.4-21.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libraw-devel-static-0.15.4-21.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libraw9-0.15.4-21.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libraw9-0.15.4-21.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP3 An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.7 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash. CVE-2018-5800 SUSE Linux Enterprise Desktop 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-static-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libraw9-0.15.4-21.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183343-1/ https://www.suse.com/security/cve/CVE-2018-5800.html CVE-2018-5800 https://bugzilla.suse.com/1084691 SUSE Bug 1084691 An error within the "LibRaw::unpack()" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference. CVE-2018-5801 SUSE Linux Enterprise Desktop 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-static-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libraw9-0.15.4-21.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183343-1/ https://www.suse.com/security/cve/CVE-2018-5801.html CVE-2018-5801 https://bugzilla.suse.com/1084690 SUSE Bug 1084690 An error within the "kodak_radc_load_raw()" function (internal/dcraw_common.cpp) related to the "buf" variable in LibRaw versions prior to 0.18.7 can be exploited to cause an out-of-bounds read memory access and subsequently cause a crash. CVE-2018-5802 SUSE Linux Enterprise Desktop 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-static-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libraw9-0.15.4-21.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183343-1/ https://www.suse.com/security/cve/CVE-2018-5802.html CVE-2018-5802 https://bugzilla.suse.com/1084688 SUSE Bug 1084688 An error within the "rollei_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash. CVE-2018-5810 SUSE Linux Enterprise Desktop 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-static-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libraw9-0.15.4-21.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183343-1/ https://www.suse.com/security/cve/CVE-2018-5810.html CVE-2018-5810 https://bugzilla.suse.com/1103353 SUSE Bug 1103353 https://bugzilla.suse.com/1118894 SUSE Bug 1118894 An error within the "parse_minolta()" function (dcraw/dcraw.c) in LibRaw versions prior to 0.18.11 can be exploited to trigger an infinite loop via a specially crafted file. CVE-2018-5813 SUSE Linux Enterprise Desktop 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw-devel-static-0.15.4-21.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libraw9-0.15.4-21.1 SUSE Linux Enterprise Workstation Extension 12 SP3:libraw9-0.15.4-21.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183343-1/ https://www.suse.com/security/cve/CVE-2018-5813.html CVE-2018-5813 https://bugzilla.suse.com/1103200 SUSE Bug 1103200