{"schemaVersion":3,"id":"MGASA-2022-0160","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated dcraw packages fix security vulnerability\n\nA buffer over-read in crop_masked_pixels in dcraw through 9.28 could be\nused by attackers able to supply malicious files to crash an application\nthat bundles the dcraw code or leak private information. (CVE-2018-19565)\n\nA heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be\nused by attackers able to supply malicious files to crash an application\nthat bundles the dcraw code or leak private information. (CVE-2018-19566)\n\nA floating point exception in parse_tiff_ifd in dcraw through 9.28 could\nbe used by attackers able to supply malicious files to crash an application\nthat bundles the dcraw code. (CVE-2018-19567)\n\nA floating point exception in kodak_radc_load_raw in dcraw through 9.28\ncould be used by attackers able to supply malicious files to crash an\napplication that bundles the dcraw code. (CVE-2018-19568)\n\nA boundary error within the \"quicktake_100_load_raw()\" function\n(internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be\nexploited to cause a stack-based buffer overflow and subsequently cause a\ncrash. (CVE-2018-5805)\n\nAn error within the \"leaf_hdr_load_raw()\" function\n(internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be\nexploited to trigger a NULL pointer dereference. (CVE-2018-5806)\n\nThere is an integer overflow vulnerability in dcraw. When the victim runs\ndcraw with a maliciously crafted X3F input image, arbitrary code may be\nexecuted in the victim's system. (CVE-2021-3624)","dates":{"published":"2022-05-06T20:16:39.000Z","modified":"2026-04-16T04:44:04.948Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"dcraw","name":"dcraw","label":"dcraw","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/dcraw","purlType":"rpm","versions":[{"text":"< 9.28.0-6.1.mga8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.28.0-6.1.mga8","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2022-0160.html","label":"advisories.mageia.org/MGASA-2022-0160.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24107","label":"bugs.mageia.org/show_bug.cgi?id=24107","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.openwall.com/lists/oss-security/2018/11/27/1","label":"www.openwall.com/lists/oss-security/2018/11/27/1","hostname":"www.openwall.com","tags":["WEB"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YDVWQ5ZUMZUOMBBPVXPXX6XNCBNZ2BMJ/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["WEB"]}],"lineage":{"upstream":["CVE-2018-19565","CVE-2018-19566","CVE-2018-19567","CVE-2018-19568","CVE-2018-5805","CVE-2018-5806","CVE-2021-3624"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-05-06T20:16:39.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-16T04:44:04.948Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:21:30.563Z","stale":false,"partial":false}}