Lucene search

[email protected]CVE-2018-5804

HistoryDec 07, 2018 - 10:29 p.m.

CVE-2018-5804

2018-12-0722:29:00

CWE-369

CWE-704

[email protected]

web.nvd.nist.gov

102

cve-2018-5804

type confusion error

identify function

libraw

division by zero

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.3 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.8%

JSON

A type confusion error within the “identify()” function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a division by zero.

Affected configurations

NVD

Node

librawlibrawRange<0.18.8

CPENameOperatorVersion
libraw:librawlibrawlt0.18.8

CPE	Name	Operator	Version
libraw:libraw	libraw	lt	0.18.8

CNA Affected

[
  {
    "product": "LibRaw",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Prior to 0.18.8"
      }
    ]
  }
]