Headline

Gentoo Linux Security Advisory 202208-07

Gentoo Linux Security Advisory 202208-7 - A buffer overread in LibRaw might allow an attacker to cause denial of service. Versions less than 0.20.2 are affected.

2 years ago

Packet Storm

Open in Source

#web #mac #linux #dos #git

Gentoo Linux Security Advisory GLSA 202208-07

                                       https://security.gentoo.org/

Severity: Low
Title: LibRaw: Stack buffer overread
Date: August 10, 2022
Bugs: #793956
ID: 202208-07

Synopsis

A buffer overread in LibRaw might allow an attacker to cause denial of
service.

Background

LibRaw is a library for reading RAW files obtained from digital photo
cameras.

Affected packages

-------------------------------------------------------------------  
 Package              /     Vulnerable     /            Unaffected  
-------------------------------------------------------------------

1 media-libs/libraw < 0.20.2 >= 0.20.2

Description

LibRaw incorrectly handles parsing DNG fields in some cases, potentially
resulting in a buffer overread leading to denial of service.

Impact

An attacker capable of providing crafted input to LibRaw could trigger denial of service.

Workaround

There is no known workaround at this time.

Resolution

All LibRaw users should upgrade to the latest version:

emerge --sync

emerge --ask --oneshot --verbose “>=media-libs/libraw-0.20.2”

References

[ 1 ] CVE-2020-24870
https://nvd.nist.gov/vuln/detail/CVE-2020-24870

Availability

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202208-07

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.