CVE-2018-19655

Published: Nov 29, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remote attacker to cause a control-flow hijack, denial-of-service, or unspecified other impact via a maliciously crafted raw photo file.

Affected (6)

Products: Dcraw Project: Dcraw · Suse: Suse Linux Enterprise Desktop, Suse Linux Enterprise Server

1 product

2 products

Suse Linux Enterprise Desktop

Suse Linux Enterprise Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dcraw Project Dcraw	Up to 9.28

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Suse Suse Linux Enterprise Desktop	Version 12 sp3
Suse Suse Linux Enterprise Desktop	Version 12 sp4
Suse Suse Linux Enterprise Server	Version 11 sp4
Suse Suse Linux Enterprise Server	Version 12 sp3
Suse Suse Linux Enterprise Server	Version 12 sp4

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (10)

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890086

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906529

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3JX4A5F4DWP6NOEULXQXZ5AIH4GA62U/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RD65NMWZ5OQNUIF7CLGKLDG4LVPPMJY7/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XK4SHVVIZT6FHJVHOQSAFJMQWDLMWKDE/

Source: cve@mitre.org

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890086

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906529

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3JX4A5F4DWP6NOEULXQXZ5AIH4GA62U/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RD65NMWZ5OQNUIF7CLGKLDG4LVPPMJY7/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XK4SHVVIZT6FHJVHOQSAFJMQWDLMWKDE/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.