CVE Vulnerabilities

CVE-2018-10529

Out-of-bounds Read

Published: Apr 29, 2018 | Modified: Jun 04, 2018
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
3.3 LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Ubuntu
MEDIUM

An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in libraw_x3f.cpp and libraw_cxx.cpp.

Weakness

The product reads data past the end, or before the beginning, of the intended buffer.

Affected Software

Name Vendor Start Version End Version
Ubuntu_linux Canonical 16.04 (including) 16.04 (including)
Ubuntu_linux Canonical 17.10 (including) 17.10 (including)
Ubuntu_linux Canonical 18.04 (including) 18.04 (including)
Darktable Ubuntu artful *
Darktable Ubuntu bionic *
Darktable Ubuntu cosmic *
Darktable Ubuntu disco *
Darktable Ubuntu eoan *
Darktable Ubuntu groovy *
Darktable Ubuntu hirsute *
Darktable Ubuntu impish *
Darktable Ubuntu kinetic *
Darktable Ubuntu lunar *
Darktable Ubuntu mantic *
Darktable Ubuntu trusty *
Darktable Ubuntu xenial *
Dcraw Ubuntu artful *
Dcraw Ubuntu bionic *
Dcraw Ubuntu cosmic *
Dcraw Ubuntu disco *
Dcraw Ubuntu eoan *
Dcraw Ubuntu groovy *
Dcraw Ubuntu hirsute *
Dcraw Ubuntu impish *
Dcraw Ubuntu kinetic *
Dcraw Ubuntu lunar *
Dcraw Ubuntu mantic *
Dcraw Ubuntu trusty *
Dcraw Ubuntu xenial *
Exactimage Ubuntu artful *
Exactimage Ubuntu bionic *
Exactimage Ubuntu cosmic *
Exactimage Ubuntu disco *
Exactimage Ubuntu eoan *
Exactimage Ubuntu groovy *
Exactimage Ubuntu hirsute *
Exactimage Ubuntu impish *
Exactimage Ubuntu kinetic *
Exactimage Ubuntu lunar *
Exactimage Ubuntu mantic *
Exactimage Ubuntu trusty *
Exactimage Ubuntu xenial *
Kodi Ubuntu artful *
Kodi Ubuntu bionic *
Kodi Ubuntu cosmic *
Kodi Ubuntu disco *
Kodi Ubuntu eoan *
Kodi Ubuntu groovy *
Kodi Ubuntu hirsute *
Kodi Ubuntu impish *
Kodi Ubuntu kinetic *
Kodi Ubuntu lunar *
Kodi Ubuntu mantic *
Kodi Ubuntu xenial *
Libraw Ubuntu artful *
Libraw Ubuntu bionic *
Libraw Ubuntu cosmic *
Libraw Ubuntu devel *
Libraw Ubuntu disco *
Libraw Ubuntu eoan *
Libraw Ubuntu focal *
Libraw Ubuntu groovy *
Libraw Ubuntu hirsute *
Libraw Ubuntu impish *
Libraw Ubuntu jammy *
Libraw Ubuntu kinetic *
Libraw Ubuntu lunar *
Libraw Ubuntu mantic *
Libraw Ubuntu noble *
Libraw Ubuntu oracular *
Libraw Ubuntu xenial *
Rawtherapee Ubuntu artful *
Rawtherapee Ubuntu bionic *
Rawtherapee Ubuntu cosmic *
Rawtherapee Ubuntu disco *
Rawtherapee Ubuntu eoan *
Rawtherapee Ubuntu groovy *
Rawtherapee Ubuntu hirsute *
Rawtherapee Ubuntu impish *
Rawtherapee Ubuntu kinetic *
Rawtherapee Ubuntu lunar *
Rawtherapee Ubuntu mantic *
Rawtherapee Ubuntu trusty *
Rawtherapee Ubuntu xenial *
Ufraw Ubuntu artful *
Ufraw Ubuntu bionic *
Ufraw Ubuntu cosmic *
Ufraw Ubuntu disco *
Ufraw Ubuntu trusty *
Ufraw Ubuntu xenial *
Xbmc Ubuntu trusty *

Potential Mitigations

  • Assume all input is malicious. Use an “accept known good” input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, “boat” may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as “red” or “blue.”
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code’s environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.

References