CVE-2018-5801

{"containers": {"cna": {"affected": [{"product": "LibRaw", "vendor": "n/a", "versions": [{"status": "affected", "version": "Prior to 0.18.7"}]}], "datePublic": "2018-12-07T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "An error within the \"LibRaw::unpack()\" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference."}], "problemTypes": [{"descriptions": [{"description": "DoS (Denial of Service) through NULL pointer dereference", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-03-28T22:06:04.000Z", "orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab", "shortName": "flexera"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"tags": ["x_refsource_MISC"], "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"name": "79000", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"name": "RHSA-2018:3065", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"name": "USN-3615-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/3615-1/"}, {"name": "[debian-lts-announce] 20190328 [SECURITY] [DLA 1734-1] libraw security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "PSIRT-CNA@flexerasoftware.com", "ID": "CVE-2018-5801", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "LibRaw", "version": {"version_data": [{"version_value": "Prior to 0.18.7"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An error within the \"LibRaw::unpack()\" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "DoS (Denial of Service) through NULL pointer dereference"}]}]}, "references": {"reference_data": [{"name": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt", "refsource": "MISC", "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"name": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/", "refsource": "MISC", "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"name": "79000", "refsource": "SECUNIA", "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"name": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914", "refsource": "MISC", "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"name": "RHSA-2018:3065", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"name": "USN-3615-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3615-1/"}, {"name": "[debian-lts-announce] 20190328 [SECURITY] [DLA 1734-1] libraw security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T05:47:55.835Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"name": "79000", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"name": "RHSA-2018:3065", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"name": "USN-3615-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/3615-1/"}, {"name": "[debian-lts-announce] 20190328 [SECURITY] [DLA 1734-1] libraw security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}]}]}, "cveMetadata": {"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab", "assignerShortName": "flexera", "cveId": "CVE-2018-5801", "datePublished": "2018-12-07T22:00:00.000Z", "dateReserved": "2018-01-19T00:00:00.000Z", "dateUpdated": "2024-08-05T05:47:55.835Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "LibRaw", "vendor": "n/a", "versions": [{"status": "affected", "version": "Prior to 0.18.7"}]}], "source": "PSIRT-CNA@flexerasoftware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libraw:libraw:*:*:*:*:*:*:*:*", "matchCriteriaId": "64A19E0C-8BED-4BFA-9287-9EB1EB760BB3", "versionEndExcluding": "0.18.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*", "matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An error within the \"LibRaw::unpack()\" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference."}, {"lang": "es", "value": "Un error en la funci\u00f3n \"LibRaw::unpack()\" (src/libraw_cxx.cpp) en LibRaw, en versiones anteriores a la 0.18.7, puede explotarse para desencadenar una desreferencia de puntero NULL."}], "id": "CVE-2018-5801", "lastModified": "2026-06-17T02:00:48.393", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-12-07T22:29:00.520", "references": [{"source": "PSIRT-CNA@flexerasoftware.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"source": "PSIRT-CNA@flexerasoftware.com", "tags": ["Release Notes"], "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"source": "PSIRT-CNA@flexerasoftware.com", "tags": ["Patch"], "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"source": "PSIRT-CNA@flexerasoftware.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}, {"source": "PSIRT-CNA@flexerasoftware.com", "tags": ["Third Party Advisory"], "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"source": "PSIRT-CNA@flexerasoftware.com", "tags": ["Third Party Advisory"], "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"source": "PSIRT-CNA@flexerasoftware.com", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/3615-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/3615-1/"}], "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2018:3065", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "libkdcraw-0:4.10.5-5.el7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2018-10-30T00:00:00Z"}], "bugzilla": {"description": "LibRaw: NULL pointer dereference in LibRaw::unpack function src/libraw_cxx.cpp", "id": "1553334", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553334"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "verified"}, "cwe": "CWE-119", "details": ["An error within the \"LibRaw::unpack()\" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference.", "A NULL pointer dereference flaw was found in the way LibRaw processed images. An attacker could potentially use this flaw to crash applications using LibRaw by tricking them into processing crafted images."], "name": "CVE-2018-5801", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "dcraw", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "dcraw", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "dcraw", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "LibRaw", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dcraw", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "LibRaw", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2018-01-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-5801\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-5801\nhttps://packetstormsecurity.com/files/146172/secunia-libraw.txt"], "threat_severity": "Low"}

{}