CVE-2017-6889 Integer overflow in LibRaw-demosaic-pack-GPL2
An integer overflow in LibRaw's foveon loader allows attackers to trigger a heap-based buffer overflow, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-6889?
CVE-2017-6889 is a critical vulnerability in LibRaw-demosaic-pack-GPL2, published on 15 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
Weakness: CWE-190
Which versions are affected by CVE-2017-6889?
It affects 1 product.
Products include Libraw Libraw-Demosaic-Pack-Gpl2.
How do I fix CVE-2017-6889?
Upgrade to a fixed version.
Is CVE-2017-6889 being exploited?
There is no known exploitation of CVE-2017-6889 in the wild and no public exploit code.
Other vulnerabilities in LibRaw-demosaic-pack-GPL2
Sources
Also known as GHSA-hh27-7rq7-g8w3.