CVE-2018-19565

Un desbordamiento de búfer basado en memoria dinámica (heap) en crop_masked_pixels, en dcraw hasta la versión 9.28, podría ser usado por atacantes para proporcionar archivos maliciosos y así forzar el cierre inesperado de una aplicación que incorpore el código dcraw o divulga información privada.

An update that fixes 11 vulnerabilities is now available. This update for dcraw fixes the following issues. Fixed a denial of service issue due to a floating point exception. Fixed an invalid memory access that could lead to information disclosure or denial of service. Fixed a buffer overflow that could lead to an application crash. Fixed an invalid memory access that could lead to denial of service. Fixed a buffer overflow that could lead to an application crash. Fixed an invalid memory access that could lead to denial of service. Fixed an invalid memory access that could lead to information disclosure or denial of service. Fixed an invalid memory access that could lead to information disclosure or denial of service. Fixed a denial of service issue due to a floating point exception. Fixed a denial of service issue due to a floating point exception. Fixed a buffer overflow that could lead to code execution or denial of service.