Memory Corruption Vulnerability in LibRaw
Summary
CVE-2017-6886: An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt memory. Affects libraw across 2 version ranges.
< 0.17.2-r1
< d7c3d2cb460be10a3ea7b32e9443a83c243b2251
Fixed in 0.17.2-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibRaw is an open-source library for reading RAW files from digital cameras. It provides a set of functions and utilities to process and manipulate RAW image data. The library is widely used in various applications and frameworks that deal with RAW image processing. However, a vulnerability has been discovered in versions of LibRaw prior to 0.18.2, which can lead to memory corruption.
Vulnerability Detail
The vulnerability, identified as CVE-2017-6886, originates from an error within the 'parse_tiff_ifd()' function in the internal/dcraw_common.cpp file of LibRaw. This error can be exploited to corrupt memory. An attacker could potentially craft a malicious TIFF image file that, when processed by an application using LibRaw, triggers the vulnerability. This could result in arbitrary code execution or a denial of service condition. The severity of this vulnerability is rated as critical, with a CVSS score of 9.8.
How To Fix
Minimum fixed version
0.17.2-r1
This is the first release that contains the fix.
sudo apk add --upgrade librawTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating to the patched version of LibRaw.
Conclusion
The memory corruption vulnerability in LibRaw (CVE-2017-6886) poses a significant risk to applications utilizing the library for RAW image processing. It is crucial to update to the fixed version (0.18.2 or later) to mitigate the vulnerability and ensure the security of the software. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libraw →
FAQ
LibRaw is an open-source library for reading RAW files from digital cameras. It provides functions and utilities to process and manipulate RAW image data.
The vulnerability allows an attacker to corrupt memory, potentially leading to arbitrary code execution or a denial of service condition.
Versions of LibRaw prior to 0.18.2 are affected by this vulnerability.
To fix this vulnerability, update LibRaw to version 0.18.2 or later.
No, there is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for libraw.
