UbuntuUpdates.org

Package "libraw"

Name: libraw

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • raw image decoder library (tools)
Latest version: 0.18.8-1ubuntu0.4
Release: bionic (18.04)
Level: updates
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "libraw" in Bionic

Repository Area Version
base main 0.18.8-1
base universe 0.18.8-1
security main 0.18.8-1ubuntu0.4
security universe 0.18.8-1ubuntu0.4
updates main 0.18.8-1ubuntu0.4

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 0.18.8-1ubuntu0.4 2022-11-07 18:06:25 UTC

  libraw (0.18.8-1ubuntu0.4) bionic-security; urgency=medium

  * SECURITY UPDATE: missing thumbnail size range checks
    - debian/patches/CVE-2020-15503.patch: add checks to
      libraw/libraw_const.h, src/libraw_cxx.cpp.
    - CVE-2020-15503
  * SECURITY UPDATE: out-of-bounds write via X3F file
    - debian/patches/CVE-2020-35530.patch: check huffman tree size in
      internal/libraw_x3f.cpp.
    - CVE-2020-35530
  * SECURITY UPDATE: out-of-bounds read in get_huffman_diff()
    - debian/patches/CVE-2020-35531.patch: check for data offset limit in
      internal/libraw_x3f.cpp.
    - CVE-2020-35531
  * SECURITY UPDATE: out-of-bounds read via a large row_stride field
    - debian/patches/CVE-2020-35532.patch: check for data offset limit in
      internal/libraw_x3f.cpp.
    - CVE-2020-35532
  * SECURITY UPDATE: out-of-bounds read in adobe_copy_pixel()
    - debian/patches/CVE-2020-35533.patch: more room for ljpeg row in
      dcraw/dcraw.c.
    - CVE-2020-35533

 -- Marc Deslauriers <email address hidden> Fri, 04 Nov 2022 14:02:18 -0400
Source diff to previous version
CVE-2020-15503 LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_util
CVE-2020-35530 In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggere
CVE-2020-35531 In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data
CVE-2020-35532 In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be t
CVE-2020-35533 In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading dat

Version: 0.18.8-1ubuntu0.3 2019-05-21 14:07:12 UTC

  libraw (0.18.8-1ubuntu0.3) bionic-security; urgency=medium

  * SECURITY UPDATE: infinite loop issues
    - debian/patches/CVE-2018-581x.patch: add more checks to dcraw/dcraw.c,
      internal/dcraw_common.cpp.
    - CVE-2018-5817
    - CVE-2018-5818
    - CVE-2018-5819
  * SECURITY UPDATE: stack overflow in parse_makernote
    - debian/patches/CVE-2018-20337.patch: properly calculate length in
      dcraw/dcraw.c, internal/dcraw_common.cpp.
    - CVE-2018-20337
  * SECURITY UPDATE: NULL deref in LibRaw::raw2image
    - debian/patches/CVE-2018-20363.patch: add check in src/libraw_cxx.cpp.
    - CVE-2018-20363
  * SECURITY UPDATE: NULL deref in LibRaw::copy_bayer
    - debian/patches/CVE-2018-20364.patch: add check in src/libraw_cxx.cpp.
    - CVE-2018-20364
  * SECURITY UPDATE: heap overflow in LibRaw::raw2image()
    - debian/patches/CVE-2018-20365.patch: zero filters in dcraw/dcraw.c,
      internal/dcraw_common.cpp.
    - CVE-2018-20365

 -- Marc Deslauriers <email address hidden> Fri, 17 May 2019 13:54:32 -0400
Source diff to previous version
CVE-2018-5817 A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw_common.cpp) can be exploited
CVE-2018-5818 An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infin
CVE-2018-5819 An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust availa
CVE-2018-20337 There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of s
CVE-2018-20363 LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
CVE-2018-20364 LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
CVE-2018-20365 LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow.

Version: 0.18.8-1ubuntu0.2 2018-12-06 04:06:25 UTC

  libraw (0.18.8-1ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Multiple memory management issues
    - debian/patches/CVE-2018-5807_5810_5811_5812.patch: out-of-bounds
      reads, heap-based buffer overflow and NULL pointer dereference in
      internal/dcraw_common.cpp
    - CVE-2018-5807
    - CVE-2018-5810
    - CVE-2018-5811
    - CVE-2018-5812
  * SECURITY UPDATE: Infinite loop
    - debian/patches/CVE-2018-5813.patch: infinite loop in dcraw/dcraw.c
      and internal/dcraw_common.cpp
    - CVE-2018-5813
  * SECURITY UPDATE: Integer overflow
    - debian/patches/CVE-2018-5815.patch: integer overflow in
      internal/dcraw_common.cpp
    - CVE-2018-5815
  * SECURITY UPDATE: Divide by zero
    - debian/patches/CVE-2018-5816.patch: divide by zero in
      internal/dcraw_common.cpp
    - CVE-2018-5816

 -- Alex Murray <email address hidden> Tue, 04 Dec 2018 15:38:46 +1030
Source diff to previous version
CVE-2018-5807 out-of-bounds read in samsung_load_raw internal/dcraw_common.cpp
CVE-2018-5810 heap-based buffer overflow in rollei_load_raw internal/dcraw_common.cpp
CVE-2018-5811 out-of-bounds read in nikon_coolscan_load_raw internal/dcraw_common.cpp
CVE-2018-5812 NULL pointer dereference in nikon_coolscan_load_raw internal/dcraw_common.cpp
CVE-2018-5813 infinite loop in the parse_minolta function in dcraw/dcraw.c
CVE-2018-5815 Integer overflow in internal/dcraw_common.cpp:parse_qt() allows for denial of service
CVE-2018-5816 Integer overflow in internal/dcraw_common.cpp:identify() allows for denial of service

Version: 0.18.8-1ubuntu0.1 2018-05-08 16:07:05 UTC

  libraw (0.18.8-1ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Stack-based buffer overflow
    - debian/patches/CVE-2018-10528.patch: parser possible
      buffer overrun in src/libraw_cxx.cpp.
    - CVE-2018-10528
  * SECURITY UPDATE: Out-of-bounds read
    - debian/patches/CVE-2018-10529.patch: X3F property table list fix
      in src/libraw_cxx.cpp, internal/libraw_x3f.cpp.
    - CVE-2018-10529

 -- <email address hidden> (Leonidas S. Barbosa) Mon, 07 May 2018 11:31:13 -0300
CVE-2018-10528 An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function in libraw_cxx.cpp.
CVE-2018-10529 An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in libraw_x3f.cpp and l


About   -   Send Feedback to @ubuntu_updates