CVE-2018-19655

Un desbordamiento de búfer basado en pila en la función find_green() de dcraw hasta la versión 9.28, tal y como se emplea en ufraw-batch y muchos otros productos, podría permitir que un atacante remoto provoque el secuestro de un flujo de control, denegación de servicio (DoS) u otro tipo de impacto sin especificar mediante un archivo de fotografía RAW maliciosamente manipulado.

An update that fixes 11 vulnerabilities is now available. This update for dcraw fixes the following issues. Fixed a denial of service issue due to a floating point exception. Fixed an invalid memory access that could lead to information disclosure or denial of service. Fixed a buffer overflow that could lead to an application crash. Fixed an invalid memory access that could lead to denial of service. Fixed a buffer overflow that could lead to an application crash. Fixed an invalid memory access that could lead to denial of service. Fixed an invalid memory access that could lead to information disclosure or denial of service. Fixed an invalid memory access that could lead to information disclosure or denial of service. Fixed a denial of service issue due to a floating point exception. Fixed a denial of service issue due to a floating point exception. Fixed a buffer overflow that could lead to code execution or denial of service.