Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 4 articles for you...
100
security advisorydenial of serviceupdateSUSE: 2022:1749-1 Moderate: dcraw Denial of Service Issues
An update that fixes 11 vulnerabilities is now available. . SUSE Security Update: Security update for dcraw ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1749-1 Rating: moderate References: #1056170 #1063798 #1084690 #1097973 #1097974 #1117436 #1117512 #1117517 #1117622 #1117896 #1189642 Cross-References: CVE-2017-13735 CVE-2017-14608 CVE-2018-19565 CVE-2018-19566 CVE-2018-19567 CVE-2018-19568 CVE-2018-19655 CVE-2018-5801 CVE-2018-5805 CVE-2018-5806 CVE-2021-3624 CVSS scores: CVE-2017-13735 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-13735 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2017-14608 (NVD) : 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2017-14608 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19565 (NVD) : 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2018-19565 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19566 (NVD) : 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2018-19566 (SUSE): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2018-19567 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19567 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19568 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19568 (SUSE): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19655 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-19655 (SUSE): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-5801 (NVD) : 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-5801 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-5805 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-5805 (SUSE): 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-5806 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-5806 (SUSE): 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3624 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3624 (SUSE): 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 12-SP5 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Linux Enterprise Software Development Kit 12-SP5 SUSE Linux Enterprise Workstation Extension 12-SP5 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for dcraw fixes the following issues: - CVE-2017-13735: Fixed a denial of service issue due to a floating point exception (bsc#1056170). - CVE-2017-14608: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1063798). - CVE-2018-19655: Fixed a buffer overflow that could lead to an application crash (bsc#1117896). - CVE-2018-5801: Fixed an invalid memory access that could lead to denial of service (bsc#1084690). - CVE-2018-5805: Fixed a buffer overflow that could lead to an application crash (bsc#1097973). - CVE-2018-5806: Fixed an invalid memory access that could lead to denial of service (bsc#1097974). - CVE-2018-19565: Fixed an invalid memory access that could lead to information disclosure or denial of service(bsc#1117622). - CVE-2018-19566: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117517). - CVE-2018-19567: Fixed a denial of service issue due to a floating point exception (bsc#1117512). - CVE-2018-19568: Fixed a denial of service issue due to a floating point exception (bsc#1117436). - CVE-2021-3624: Fixed a buffer overflow that could lead to code execution or denial of service (bsc#1189642). Non-security fixes: - Updated to version 9.28.0. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP5: zypper in -t patch SUSE-SLE-WE-12-SP5-2022-1749=1 - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-1749=1 Package List: - SUSE Linux Enterprise Workstation Extension 12-SP5 (noarch): dcraw-lang-9.28.0-3.3.1 - SUSE Linux Enterprise Workstation Extension 12-SP5 (x86_64): dcraw-9.28.0-3.3.1 dcraw-debuginfo-9.28.0-3.3.1 dcraw-debugsource-9.28.0-3.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64): dcraw-9.28.0-3.3.1 dcraw-debuginfo-9.28.0-3.3.1 dcraw-debugsource-9.28.0-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-13735.html https://www.suse.com/security/cve/CVE-2017-14608.html https://www.suse.com/security/cve/CVE-2018-19565.html https://www.suse.com/security/cve/CVE-2018-19566.html https://www.suse.com/security/cve/CVE-2018-19567.html https://www.suse.com/security/cve/CVE-2018-19568.html https://www.suse.com/security/cve/CVE-2018-19655.html https://www.suse.com/security/cve/CVE-2018-5801.html https://www.suse.com/security/cve/CVE-2018-5805.html https://www.suse.com/security/cve/CVE-2018-5806.html https://www.suse.com/security/cve/CVE-2021-3624.html https://bugzilla.suse.com/1056170 https://bugzilla.suse.com/1063798 https://bugzilla.suse.com/1084690 https://bugzilla.suse.com/1097973 https://bugzilla.suse.com/1097974 https://bugzilla.suse.com/1117436 https://bugzilla.suse.com/1117512 https://bugzilla.suse.com/1117517 https://bugzilla.suse.com/1117622 https://bugzilla.suse.com/1117896 https://bugzilla.suse.com/1189642 . SUSE has released a new version of dcraw to fix 11 security issues, among them are risks related to buffer overflows and denial of service attacks. Immediate action is recommended.. SUSE Linux,drawing software,dcraw,security patch,denial of service. . LinuxSecurity.com Team
May 19, 2022
SuSE
203
security advisorymoderate threatattack protectionMageia 8 MGASA-2022-0160 Moderate: dcraw Buffer Over-Read Threat
A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. (CVE-2018-19565) A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be . MGASA-2022-0160 - Updated dcraw packages fix security vulnerability Publication date: 06 May 2022 URL: https://advisories.mageia.org/MGASA-2022-0160.html Type: security Affected Mageia releases: 8 CVE: CVE-2018-5805, CVE-2018-5806, CVE-2018-19565, CVE-2018-19566, CVE-2018-19567, CVE-2018-19568, CVE-2021-3624 A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. (CVE-2018-19565) A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. (CVE-2018-19566) A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. (CVE-2018-19567) A floating point exception in kodak_radc_load_raw in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. (CVE-2018-19568) A boundary error within the "quicktake_100_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a crash. (CVE-2018-5805) An error within the "leaf_hdr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806) There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code maybe executed in the victim's system. (CVE-2021-3624) References: - https://bugs.mageia.org/show_bug.cgi?id=24107 - https://www.openwall.com/lists/oss-security/2018/11/27/1 - - https://www.cve.org/CVERecord?id=CVE-2018-5805 - https://www.cve.org/CVERecord?id=CVE-2018-5806 - https://www.cve.org/CVERecord?id=CVE-2018-19565 - https://www.cve.org/CVERecord?id=CVE-2018-19566 - https://www.cve.org/CVERecord?id=CVE-2018-19567 - https://www.cve.org/CVERecord?id=CVE-2018-19568 - https://www.cve.org/CVERecord?id=CVE-2021-3624 SRPMS: - 8/core/dcraw-9.28.0-6.1.mga8 . Mageia 2022-0161 tackles critical vulnerabilities in libjpeg-turbo affecting system performance and image handling. Check out the specifics now.. Mageia Security Update, dcraw Buffer Overread, Attack Protection. . LinuxSecurity.com Team
May 06, 2022
Mageia
100
security advisorydenial of servicesoftware updateopenSUSE Leap 15.3/15.4: 2022:1277-1 Moderate: dcraw Denial of Service Fix
An update that fixes 11 vulnerabilities is now available. . SUSE Security Update: Security update for dcraw ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1277-1 Rating: moderate References: #1056170 #1063798 #1084690 #1097973 #1097974 #1117436 #1117512 #1117517 #1117622 #1117896 #1189642 Cross-References: CVE-2017-13735 CVE-2017-14608 CVE-2018-19565 CVE-2018-19566 CVE-2018-19567 CVE-2018-19568 CVE-2018-19655 CVE-2018-5801 CVE-2018-5805 CVE-2018-5806 CVE-2021-3624 CVSS scores: CVE-2017-13735 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-13735 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2017-14608 (NVD) : 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2017-14608 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19565 (NVD) : 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2018-19565 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19566 (NVD) : 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2018-19566 (SUSE): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2018-19567 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19567 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-19568 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19568 (SUSE): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-19655 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-19655 (SUSE): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-5801 (NVD) : 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-5801 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-5805 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-5805 (SUSE): 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-5806 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-5806 (SUSE): 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3624 (SUSE): 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for dcraw fixes the following issues: - CVE-2017-13735: Fixed a denial of service issue due to a floating point exception (bsc#1056170). - CVE-2017-14608: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1063798). - CVE-2018-19655: Fixed a buffer overflow that could lead to an application crash (bsc#1117896). - CVE-2018-5801: Fixed an invalid memory access that could lead to denial of service (bsc#1084690). - CVE-2018-5805: Fixed a buffer overflow that could lead to an application crash (bsc#1097973). - CVE-2018-5806: Fixed an invalid memory access that could lead to denial of service (bsc#1097974). - CVE-2018-19565: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117622). - CVE-2018-19566: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117517). - CVE-2018-19567: Fixed a denial of service issue due to a floating point exception (bsc#1117512). - CVE-2018-19568: Fixed a denial of service issue due to a floating point exception(bsc#1117436). - CVE-2021-3624: Fixed a buffer overflow that could lead to code execution or denial of service (bsc#1189642). Non-security fixes: - Updated to version 9.28.0. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1277=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1277=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): dcraw-9.28.0-150000.3.3.1 dcraw-debuginfo-9.28.0-150000.3.3.1 dcraw-debugsource-9.28.0-150000.3.3.1 - openSUSE Leap 15.4 (noarch): dcraw-lang-9.28.0-150000.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dcraw-9.28.0-150000.3.3.1 dcraw-debuginfo-9.28.0-150000.3.3.1 dcraw-debugsource-9.28.0-150000.3.3.1 - openSUSE Leap 15.3 (noarch): dcraw-lang-9.28.0-150000.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-13735.html https://www.suse.com/security/cve/CVE-2017-14608.html https://www.suse.com/security/cve/CVE-2018-19565.html https://www.suse.com/security/cve/CVE-2018-19566.html https://www.suse.com/security/cve/CVE-2018-19567.html https://www.suse.com/security/cve/CVE-2018-19568.html https://www.suse.com/security/cve/CVE-2018-19655.html https://www.suse.com/security/cve/CVE-2018-5801.html https://www.suse.com/security/cve/CVE-2018-5805.html https://www.suse.com/security/cve/CVE-2018-5806.html https://www.suse.com/security/cve/CVE-2021-3624.html https://bugzilla.suse.com/1056170 https://bugzilla.suse.com/1063798 https://bugzilla.suse.com/1084690 https://bugzilla.suse.com/1097973 https://bugzilla.suse.com/1097974 https://bugzilla.suse.com/1117436 https://bugzilla.suse.com/1117512 https://bugzilla.suse.com/1117517 https://bugzilla.suse.com/1117622 https://bugzilla.suse.com/1117896 https://bugzilla.suse.com/1189642 . Security enhancements for dcraw now released in openSUSE, fixing 11 vulnerabilities, such as potential denial of service and unsafe memory handling issues.. openSUSE Patches, dcraw Security Update, Software Vulnerabilities. . LinuxSecurity.com Team
Apr 20, 2022
SuSE
89
security advisorycritical issuesoftware updateFedora 30: 2020-545493aa4b Critical Fix for dcraw CVE-2018-19655
Fix CVE-2018-19655. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-545493aa4b 2020-03-29 01:59:18.673356 --------------------------------------------------------------------------------Name : dcraw Product : Fedora 30 Version : 9.28.0 Release : 9.fc30 URL : http://www.dechifro.org/dcraw/ Summary : Tool for decoding raw image data from digital cameras Description : This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras. --------------------------------------------------------------------------------Update Information: Fix CVE-2018-19655 --------------------------------------------------------------------------------ChangeLog: * Fri Mar 20 2020 Josef Ridky - 9.28.0-9 - Fix CVE-2018-19655 * Tue Jan 28 2020 Fedora Release Engineering - 9.28.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Tue Jan 14 2020 Tom Stellard - 9.28.0-7 - Use __cc macro instead of hard-coding gcc * Wed Jul 24 2019 Fedora Release Engineering - 9.28.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Fri Jun 28 2019 Josef Ridky - 9.28.0-5 - set new upstream url --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-545493aa4b' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 28, 2020
•Critical
Fedora
89
security advisoryfedorabuffer overflowFedora 32: FEDORA-2020-29d7f4d35d High: lighttpd Memory Leak
Fix CVE-2018-19655. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-19c7f8e25f 2020-03-29 01:36:32.572872 --------------------------------------------------------------------------------Name : dcraw Product : Fedora 31 Version : 9.28.0 Release : 9.fc31 URL : http://www.dechifro.org/dcraw/ Summary : Tool for decoding raw image data from digital cameras Description : This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras. --------------------------------------------------------------------------------Update Information: Fix CVE-2018-19655 --------------------------------------------------------------------------------ChangeLog: * Fri Mar 20 2020 Josef Ridky - 9.28.0-9 - Fix CVE-2018-19655 * Tue Jan 28 2020 Fedora Release Engineering - 9.28.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Tue Jan 14 2020 Tom Stellard - 9.28.0-7 - Use __cc macro instead of hard-coding gcc --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-19c7f8e25f' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 28, 2020
Fedora
89
security advisoryfedorasecurity fixFedora 32 - FEDORA-2020-ef1ff20b59 Critical: dcraw Security Fix
Fix CVE-2018-19655. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-ef1ff20b59 2020-03-29 00:14:52.079997 --------------------------------------------------------------------------------Name : dcraw Product : Fedora 32 Version : 9.28.0 Release : 9.fc32 URL : http://www.dechifro.org/dcraw/ Summary : Tool for decoding raw image data from digital cameras Description : This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras. --------------------------------------------------------------------------------Update Information: Fix CVE-2018-19655 --------------------------------------------------------------------------------ChangeLog: * Fri Mar 20 2020 Josef Ridky - 9.28.0-9 - Fix CVE-2018-19655 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-ef1ff20b59' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 28, 2020
•Critical
Fedora
203
security advisorysecurity issueNULL pointerMageia: 2019-0017 Moderate: dcraw NULL Pointer Crash Risk
A NULL pointer dereference flaw was found in the way dcraw processed images. An attacker could potentially use this flaw to crash dcraw by tricking it into processing crafted images (CVE-2018-5801). References: . MGASA-2019-0017 - Updated dcraw packages fix security vulnerability Publication date: 06 Jan 2019 URL: https://advisories.mageia.org/MGASA-2019-0017.html Type: security Affected Mageia releases: 6 CVE: CVE-CVE-2018-5801 A NULL pointer dereference flaw was found in the way dcraw processed images. An attacker could potentially use this flaw to crash dcraw by tricking it into processing crafted images (CVE-2018-5801). References: - https://bugs.mageia.org/show_bug.cgi?id=23252 - https://lists.fedoraproject.org/archives/list/
Jan 06, 2019
Mageia
89
security advisoryupdateFedoraFedora 27: dcraw 9.28.0 Moderate: NULL Pointer Dereference Fix
New version of dcraw is available 9.28.0 Security fix for CVE-2018-5801. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-ae1ced8fb6 2018-07-25 18:44:08.975117 --------------------------------------------------------------------------------Name : dcraw Product : Fedora 27 Version : 9.28.0 Release : 1.fc27 URL : Summary : Tool for decoding raw image data from digital cameras Description : This package contains dcraw, a command line tool to decode raw image data downloaded from digital cameras. --------------------------------------------------------------------------------Update Information: New version of dcraw is available 9.28.0 Security fix for CVE-2018-5801 --------------------------------------------------------------------------------ChangeLog: * Thu Jun 14 2018 Josef Ridky - 9.28.0-1 - New upstream release 9.28.0 (#1585348) - Fix CVE-2018-5801 (#1557160) * Fri Feb 23 2018 Florian Weimer - 9.27.0-8 - Use LDFLAGS from redhat-rpm-config * Tue Feb 20 2018 Nils Philippsen - 9.27.0-7 - require gcc for building * Wed Feb 7 2018 Fedora Release Engineering - 9.27.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1553334 - CVE-2018-5801 LibRaw: NULL pointer dereference in LibRaw::unpack function src/libraw_cxx.cpp https://bugzilla.redhat.com/show_bug.cgi?id=1553334 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-ae1ced8fb6' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 25, 2018
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!