CVE-2018-19566
published 2018-11-26CVE-2018-19566: A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles…
PriorityP423high7.1CVSS 3.0
AVLACLPRNUIRSUCHINAH
EPSS
1.07%
61.2th percentile
A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dcraw_project | dcraw | <= 9.28 | — |
| debian | dcraw | — | — |
CVSS provenance
nvdv3.07.1HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:P
osv7.1HIGH
vendor_debian7.1LOW
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qchv-v695-4m9x: A heap buffer over-read in parse_tiff_ifd in dcraw through 9
ghsa_unreviewed·2022-05-14
CVE-2018-19566 [HIGH] CWE-125 GHSA-qchv-v695-4m9x: A heap buffer over-read in parse_tiff_ifd in dcraw through 9
A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.
OSV
CVE-2018-19566: A heap buffer over-read in parse_tiff_ifd in dcraw through 9
osv·2018-11-26·CVSS 7.1
CVE-2018-19566 [HIGH] CVE-2018-19566: A heap buffer over-read in parse_tiff_ifd in dcraw through 9
A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.
Red Hat
dcraw: Heap buffer over-read in parse_tiff_ifd resulting in a denial of service or information leak
vendor_redhat·2018-11-23·CVSS 7.1
CVE-2018-19566 [HIGH] CWE-125 dcraw: Heap buffer over-read in parse_tiff_ifd resulting in a denial of service or information leak
dcraw: Heap buffer over-read in parse_tiff_ifd resulting in a denial of service or information leak
A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.
Package: dcraw (Red Hat Enterprise Linux 5) - Will not fix
Package: dcraw (Red Hat Enterprise Linux 6) - Will not fix
Package: dcraw (Red Hat Enterprise Linux 7) - Fix deferred
Package: dcraw (Red Hat Enterprise Linux 8) - Fix deferred
Debian
CVE-2018-19566: dcraw - A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by...
vendor_debian·2018·CVSS 7.1
CVE-2018-19566 [HIGH] CVE-2018-19566: dcraw - A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by...
A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
2018-11-26
Published