LibRaw CVE-2013-1439 Multiple NULL Pointer Dereference Denial of Service Vulnerabilities

Bugtraq ID:	62057
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-1439
Remote:	Yes
Local:	No
Published:	Aug 29 2013 12:00AM
Updated:	May 07 2015 05:11PM
Credit:	Raphael Geissert
Vulnerable:	Ubuntu Ubuntu Linux 13.04 Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 LibRaw LibRaw 0.15.2 LibRaw LibRaw 0.15.1 LibRaw LibRaw 0.15 LibRaw LibRaw 0.15.3 LibRaw LibRaw 0.13 Gentoo Linux
Not Vulnerable:	LibRaw LibRaw 0.15.4

LibRaw CVE-2013-1439 Multiple NULL Pointer Dereference Denial of Service Vulnerabilities

LibRaw is prone to multiple denial-of-service vulnerabilities caused by NULL-pointer dereference errors.

An attacker can exploit these issues to crash the application running the affected library, denying service to legitimate users.

LibRaw versions 0.13 through 0.15 are vulnerable.

LibRaw CVE-2013-1439 Multiple NULL Pointer Dereference Denial of Service Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

LibRaw CVE-2013-1439 Multiple NULL Pointer Dereference Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

LibRaw CVE-2013-1439 Multiple NULL Pointer Dereference Denial of Service Vulnerabilities

References:

• cumulated data checks patch (alextutubalin)
  
• LibRaw Homepage (LibRaw)
  
• libraw: multiple denial of service vulnerabilities (Raphael Geissert)
  
• LibRaw, libkdcraw: Multiple vulnerabilities (Gentoo)