imagemagick:encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::parse_sinar_ia

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6585575793033216 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp postprocessing/mem_image.cpp and utils/thumb_utils.cpp. For example malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.

...

libraw:libraw_cr2_fuzzer: Index-out-of-bounds in AAHD::make_ahd_rb_hv

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=4713405714333696 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawcr2fuzzer Job Type: libfuzzerubsanlibraw Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

libraw:libraw_cr2_fuzzer: Use-of-uninitialized-value in LibRaw::parseLeicaMakernote

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=6494926154563584 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawcr2fuzzer Job Type: libfuzzermsanlibraw Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

CVE-2020-15503 affecting package LibRaw for versions less than 0.19.5-5

CVE-2020-15503 affecting package LibRaw for versions less than 0.19.5-5. A patched version of the package is available...

libraw:libraw_cr2_fuzzer: Use-of-uninitialized-value in libraw_sget2_static

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=5740614407225344 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawcr2fuzzer Job Type: libfuzzermsanlibraw Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

imagemagick:encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::kodak_NUMBER_load_raw

Detailed Report: https://oss-fuzz.com/testcase?key=6311467738005504 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::kodakNUMBERloadraw...

OPENSUSE-SU-2024:10980-1 libraw-devel-0.20.2-4.1 on GA media

These are all security issues fixed in the libraw-devel-0.20.2-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10156-1 libraw-devel-0.17.2-1.4 on GA media

These are all security issues fixed in the libraw-devel-0.17.2-1.4 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13252-1 libraw-devel-0.21.1-3.1 on GA media

These are all security issues fixed in the libraw-devel-0.21.1-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12901-1 libraw-devel-0.21.1-2.1 on GA media

These are all security issues fixed in the libraw-devel-0.21.1-2.1 package on the GA media of openSUSE Tumbleweed...

imagemagick:encoder_dng_fuzzer: Index-out-of-bounds in LibRaw::ahd_interpolate_r_and_b_in_rgb_and_convert_to_cielab

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5965028352655360 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzerubsanimagemagick Platform Id: linux Crash Type: Index-out-of-bounds Crash...

RLSA-2024:2994 Moderate: LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras CRW/CR2, NEF, RAF, DNG, and others. Security Fixes: LibRaw: stack buffer overflow in LibRawbufferdatastream::gets in src/librawdatastream.cpp CVE-2021-32142 For more details about the security issues, including the...

LibRaw security update

An update is available for LibRaw. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list LibRaw is a library for reading RAW files obtained from digital photo cameras...

Rocky Linux 8 : LibRaw (RLSA-2024:2994)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:2994 advisory. LibRaw: stack buffer overflow in LibRawbufferdatastream::gets in src/librawdatastream.cpp CVE-2021-32142 Tenable has extracted the preceding description block...

RHEL 8 : libraw (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - LibRaw: Out-of-bounds read in X3F property table list functionality in librawx3f.cpp and librawcxx.cpp...

RHEL 6 : dcraw (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - LibRaw: Memory objects are not intialized properly CVE-2015-8367 - Unspecified vulnerability in dcraw 0.8...

RHEL 7 : libraw (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - libraw: Memory corruption in the parsetiffifd CVE-2017-6886 - A boundary error within the parsetiffifd...

RHEL 5 : dcraw (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - LibRaw: Index overflow in smaldecodesegment CVE-2015-8366 - Unspecified vulnerability in dcraw 0.8.x...

Oracle Linux 8 : LibRaw (ELSA-2024-2994)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2994 advisory. 0.19.5-4 - Backport fix for CVE-2021-32142 from upstream Resolves: RHEL-9523 Tenable has extracted the preceding description block directly from the Oracle Linu...