Mageia alert MGASA-2020-0157 (dcraw)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2020-0157: Updated dcraw packages fix security vulnerabilities 
Date:
             
 
Sat, 4 Apr 2020 00:54:30 +0200
Message-ID:
             
 
<20200403225430.BC3679F640@duvel.mageia.org>
MGASA-2020-0157 - Updated dcraw packages fix security vulnerabilities

Publication date: 03 Apr 2020
URL: https://advisories.mageia.org/MGASA-2020-0157.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2017-13735,
     CVE-2017-14608,
     CVE-2018-19655

Description:
The updated packages fix security vulnerabilities:

There is a floating point exception in the kodak_radc_load_raw function
in dcraw_common.cpp in LibRaw 0.18.2. It will lead to a remote denial
of service attack. (CVE-2017-13735)

In LibRaw through 0.18.4, an out of bounds read flaw related to
kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/
dcraw_common.cpp. An attacker could possibly exploit this flaw to
disclose potentially sensitive memory or cause an application crash.
(CVE-2017-14608)

A stack-based buffer overflow in the find_green() function of dcraw
through 9.28, as used in ufraw-batch and many other products, may allow
a remote attacker to cause a control-flow hijack, denial-of-service, or
unspecified other impact via a maliciously crafted raw photo file.
(CVE-2018-19655)

References:
- https://bugs.mageia.org/show_bug.cgi?id=26406
- https://bugs.mageia.org/show_bug.cgi?id=21757
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1...

SRPMS:
- 7/core/dcraw-9.28.0-2.1.mga7