Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[cximage] Fix denial of service via a crafted photo file (CVE-2013-1438) #4179

Merged
merged 1 commit into from
Feb 9, 2014
Merged

[cximage] Fix denial of service via a crafted photo file (CVE-2013-1438) #4179

merged 1 commit into from
Feb 9, 2014

Commits on Feb 9, 2014

  1. [cximage] Fix denial of service via a crafted photo file (CVE-2013-1438) 

    Embedded CxImage embeds a copy of libDCR, a fork of dcraw.c, which
contains several denial of service vulnerabilities as discovered by
Raphael Geissert. These seem to affect the CxImage-embedded libDCR as
well.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1438
----
Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in
libraw, ufraw, shotwell, and other products, allows context-dependent
attackers to cause a denial of service via a crafted photo file that
triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer
dereference.
----

Port the fix from libRaw [1] to CxImage copy of libDCR. The patch has
been submitted upstream.

[1]
LibRaw/LibRaw@9ae25d8
    @anssih
    anssih committed Feb 9, 2014
    4 Configuration menu
    Copy the full SHA
    d13aee8 View commit details
    Browse the repository at this point in the history