{"containers": {"cna": {"affected": [{"product": "LibRaw", "vendor": "n/a", "versions": [{"status": "affected", "version": "Prior to 0.18.7"}]}], "datePublic": "2018-12-07T00:00:00", "descriptions": [{"lang": "en", "value": "An error within the \"LibRaw::unpack()\" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference."}], "problemTypes": [{"descriptions": [{"description": "DoS (Denial of Service) through NULL pointer dereference", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-03-28T22:06:04", "orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab", "shortName": "flexera"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"tags": ["x_refsource_MISC"], "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"name": "79000", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"name": "RHSA-2018:3065", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"name": "USN-3615-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/3615-1/"}, {"name": "[debian-lts-announce] 20190328 [SECURITY] [DLA 1734-1] libraw security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2018-5801", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "LibRaw", "version": {"version_data": [{"version_value": "Prior to 0.18.7"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An error within the \"LibRaw::unpack()\" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "DoS (Denial of Service) through NULL pointer dereference"}]}]}, "references": {"reference_data": [{"name": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt", "refsource": "MISC", "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"name": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/", "refsource": "MISC", "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"name": "79000", "refsource": "SECUNIA", "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"name": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914", "refsource": "MISC", "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"name": "RHSA-2018:3065", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"name": "USN-3615-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3615-1/"}, {"name": "[debian-lts-announce] 20190328 [SECURITY] [DLA 1734-1] libraw security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T05:47:55.835Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"name": "79000", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"name": "RHSA-2018:3065", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"name": "USN-3615-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/3615-1/"}, {"name": "[debian-lts-announce] 20190328 [SECURITY] [DLA 1734-1] libraw security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}]}]}, "cveMetadata": {"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab", "assignerShortName": "flexera", "cveId": "CVE-2018-5801", "datePublished": "2018-12-07T22:00:00", "dateReserved": "2018-01-19T00:00:00", "dateUpdated": "2024-08-05T05:47:55.835Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libraw:libraw:*:*:*:*:*:*:*:*", "matchCriteriaId": "64A19E0C-8BED-4BFA-9287-9EB1EB760BB3", "versionEndExcluding": "0.18.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*", "matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An error within the \"LibRaw::unpack()\" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference."}, {"lang": "es", "value": "Un error en la funci\u00f3n \"LibRaw::unpack()\" (src/libraw_cxx.cpp) en LibRaw, en versiones anteriores a la 0.18.7, puede explotarse para desencadenar una desreferencia de puntero NULL."}], "id": "CVE-2018-5801", "lastModified": "2024-11-21T04:09:26.087", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2018-12-07T22:29:00.520", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"source": "[email protected]", "tags": ["Release Notes"], "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"source": "[email protected]", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/3615-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:3065"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/LibRaw/LibRaw/blob/master/Changelog.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/LibRaw/LibRaw/commit/0df5490b985c419de008d32168650bff17128914"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00036.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://secuniaresearch.flexerasoftware.com/advisories/79000/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://secuniaresearch.flexerasoftware.com/secunia_research/2018-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://usn.ubuntu.com/3615-1/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2018:3065", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "libkdcraw-0:4.10.5-5.el7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2018-10-30T00:00:00Z"}], "bugzilla": {"description": "LibRaw: NULL pointer dereference in LibRaw::unpack function src/libraw_cxx.cpp", "id": "1553334", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553334"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "verified"}, "cwe": "CWE-119", "details": ["An error within the \"LibRaw::unpack()\" function (src/libraw_cxx.cpp) in LibRaw versions prior to 0.18.7 can be exploited to trigger a NULL pointer dereference.", "A NULL pointer dereference flaw was found in the way LibRaw processed images. An attacker could potentially use this flaw to crash applications using LibRaw by tricking them into processing crafted images."], "name": "CVE-2018-5801", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "dcraw", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Will not fix", "package_name": "dcraw", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "dcraw", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "LibRaw", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "dcraw", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "LibRaw", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2018-01-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-5801\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-5801\nhttps://packetstormsecurity.com/files/146172/secunia-libraw.txt"], "threat_severity": "Low", "upstream_fix": "LibRaw 0.18.7"}