Description
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
LibRaw LibRaw
Default version status: unaffected
0 to ≤ 0.22.2affected
pkg:github/LibRaw/LibRawReferences
- https://hackmd.io/@haind-pwn/libraw-nikon-shotinfo-orientationoffset-oob-read ↗
- https://github.com/LibRaw/LibRaw/blob/b93f6e45c194f5df9b02a43b1af9a54b4f41f33f/src/metadata/nikon.cpp#L873-L967 ↗
- https://github.com/LibRaw/LibRaw ↗
- https://www.vulncheck.com/advisories/libraw-through-0.22.2-heap-out-of-bounds-read-via-parsenikonmakernote-shotinfo ↗