libraw: CVE-2018-20364

Debian Bug report logs - #917112
libraw: CVE-2018-20364

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libraw: CVE-2018-20364

Date: Sat, 22 Dec 2018 21:29:59 +0100

Source: libraw
Version: 0.19.1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/LibRaw/LibRaw/issues/194

Hi,

The following vulnerability was published for libraw.

CVE-2018-20364[0]:
| LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL
| pointer dereference.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-20364
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20364
[1] https://github.com/LibRaw/LibRaw/issues/194

Please adjust the affected versions in the BTS as needed.


Regards,
Salvatore

Message #12 received at 917112-done@bugs.debian.org (full text, mbox, reply):

From: "Matteo F. Vescovi" <mfv@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 917112-done@bugs.debian.org

Subject: Re: Bug#917112: libraw: CVE-2018-20364

Date: Thu, 27 Dec 2018 21:49:28 +0100

[Message part 1 (text/plain, inline)]

Version: 0.19.2-1

Hi!

On 2018-12-22 at 21:29 (+01), Salvatore Bonaccorso wrote:
> Source: libraw
> Version: 0.19.1-1
> Severity: important
> Tags: security upstream
> Forwarded: https://github.com/LibRaw/LibRaw/issues/194

[...]

The new version above fixes this security vulnerability.

Thus, closing.

Cheers.


-- 
Matteo F. Vescovi || Debian Developer
GnuPG KeyID: 4096R/0x8062398983B2CF7A

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 917112-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 917111-submitter@bugs.debian.org, 917112-submitter@bugs.debian.org, 917113-submitter@bugs.debian.org

Subject: notfixed 917111 in 0.19.2-1, notfixed 917112 in 0.19.2-1, notfixed 917113 in 0.19.2-1, closing 917111 ...

Date: Thu, 10 Jan 2019 23:24:54 +0100

# not completely fixed in 0.19.2 upstream
notfixed 917111 0.19.2-1
notfixed 917112 0.19.2-1
notfixed 917113 0.19.2-1
# adding additional required patch
close 917111 0.19.2-2
close 917112 0.19.2-2
close 917113 0.19.2-2
thanks

Send a report that this bug log contains spam.