[manjaro-security] [ASA-201805-2] libraw: multiple issues
Jelle van der Waa
jelle at archlinux.org
Wed May 9 22:12:39 CEST 2018
Arch Linux Security Advisory ASA-201805-2
Date : 2018-05-09
CVE-ID : CVE-2018-10528 CVE-2018-10529
Package : libraw
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-681
The package libraw before version 0.18.10-1 is vulnerable to multiple
issues including arbitrary code execution and information disclosure.
Upgrade to 0.18.10-1.
# pacman -Syu "libraw>=0.18.10-1"
The problems have been fixed upstream in version 0.18.10.
- CVE-2018-10528 (arbitrary code execution)
A stack-based buffer overflow has been found in LibRaw before 0.18.10,
in the utf2char() function in libraw_cxx.cpp.
- CVE-2018-10529 (information disclosure)
An out-of-bounds read has been found in LibRaw before 0.18.10, in the
X3F property table list implementation in libraw_x3f.cpp and
A remote attacker is able to execute arbitrary code or disclose
information by providing a specially crafted file.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 488 bytes
Desc: not available
More information about the manjaro-security