CVE-2018-5815

NameCVE-2018-5815
DescriptionAn integer overflow error within the "parse_qt()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.12 can be exploited to trigger an infinite loop via a specially crafted Apple QuickTime file.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2903-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libraw (PTS)bullseye0.20.2-1+deb11u1fixed
bullseye (security)0.20.2-1+deb11u2fixed
bookworm0.20.2-2.1+deb12u1fixed
forky, sid, trixie0.21.4-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
librawsourcestretch0.17.2-6+deb9u2DLA-2903-1
librawsource(unstable)0.18.13-1low

Notes

http://seclists.org/bugtraq/2018/Jul/58
https://github.com/LibRaw/LibRaw/commit/1334647862b0c90b2e8cb2f668e66627d9517b17
Search for package or bug name: Reporting problems