Re: [BLFS Trac] #23109: LibRaw-0.22.1

#23109: LibRaw-0.22.1
-------------------------+---------------------
 Reporter:  Bruce Dubbs  |       Owner:  pierre
     Type:  enhancement  |      Status:  closed
 Priority:  normal       |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:  fixed
 Keywords:               |
-------------------------+---------------------
Comment (by Douglas R. Reno):

 Security information is now available from oss-security for the TALOS
 issues:

 {{{
 Further information about the vulnerabilities reported by Cisco Talos can
 be
 found in their reports:

 - TALOS-2026-2330 / CVE-2026-20911
   LibRaw HuffTable::initval heap-based buffer overflow vulnerability
   https://talosintelligence.com/vulnerability_reports/TALOS-2026-2330

   A heap-based buffer overflow vulnerability exists in the
 HuffTable::initval
   functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially
   crafted malicious file can lead to a heap buffer overflow. An attacker
   can provide a malicious file to trigger this vulnerability.

 - TALOS-2026-2331 / CVE-2026-21413
   LibRaw lossless_jpeg_load_raw heap-based buffer overflow vulnerability
   https://talosintelligence.com/vulnerability_reports/TALOS-2026-2331

   A heap-based buffer overflow vulnerability exists in the
   lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and
   Commit d20315b. A specially crafted malicious file can lead to a heap
 buffer
   overflow. An attacker can provide a malicious file to trigger this
   vulnerability.

 - TALOS-2026-2358 / CVE-2026-20889
   LibRaw x3f_thumb_loader heap-based buffer overflow vulnerability
   https://talosintelligence.com/vulnerability_reports/TALOS-2026-2358

   A heap-based buffer overflow vulnerability exists in the
 x3f_thumb_loader
   functionality of LibRaw Commit d20315b. A specially crafted malicious
 file
   can lead to a heap buffer overflow. An attacker can provide a malicious
 file
   to trigger this vulnerability.

 - TALOS-2026-2359 / CVE-2026-24660
   LibRaw x3f_load_huffman heap-based buffer overflow vulnerability
   https://talosintelligence.com/vulnerability_reports/TALOS-2026-2359

   A heap-based buffer overflow vulnerability exists in the
 x3f_load_huffman
   functionality of LibRaw Commit d20315b. A specially crafted malicious
 file
   can lead to a heap buffer overflow. An attacker can provide a malicious
 file
   to trigger this vulnerability.

 - TALOS-2026-2363 / CVE-2026-24450
   LibRaw uncompressed_fp_dng_load_raw integer overflow vulnerability
   https://talosintelligence.com/vulnerability_reports/TALOS-2026-2363

   An integer overflow vulnerability exists in the
 uncompressed_fp_dng_load_raw
   functionality of LibRaw Commit 8dc68e2. A specially crafted malicious
 file
   can lead to a heap buffer overflow. An attacker can provide a malicious
 file
   to trigger this vulnerability.

 - TALOS-2026-2364 / CVE-2026-20884
   LibRaw deflate_dng_load_raw integer overflow vulnerability
   https://talosintelligence.com/vulnerability_reports/TALOS-2026-2364

   An integer overflow vulnerability exists in the deflate_dng_load_raw
   functionality of LibRaw Commit 8dc68e2. A specially crafted malicious
 file
   can lead to a heap buffer overflow. An attacker can provide a malicious
 file
   to trigger this vulnerability.

 Additional CVEs also appear to have been issued for some of the fixes:

 - CVE-2026-5318 appears to be a duplicate for independent reporting of the
   TALOS-2026-2330 / CVE-2026-20911 issue in
   https://github.com/LibRaw/LibRaw/issues/794

 - CVE-2026-5342 for the fix listed above as "Nikon padded/12bit: no need
 to
   calculate padded row size before final raw_width adjustment" and
 originally
   reported in https://github.com/LibRaw/LibRaw/issues/795
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23109#comment:4>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page