104 lines
5.9 KiB
XML
104 lines
5.9 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
|
<DocumentTitle xml:lang="en">An update for LibRaw is now available for openEuler-22.03-LTS-SP3</DocumentTitle>
|
|
<DocumentType>Security Advisory</DocumentType>
|
|
<DocumentPublisher Type="Vendor">
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
|
</DocumentPublisher>
|
|
<DocumentTracking>
|
|
<Identification>
|
|
<ID>openEuler-SA-2024-1339</ID>
|
|
</Identification>
|
|
<Status>Final</Status>
|
|
<Version>1.0</Version>
|
|
<RevisionHistory>
|
|
<Revision>
|
|
<Number>1.0</Number>
|
|
<Date>2024-03-29</Date>
|
|
<Description>Initial</Description>
|
|
</Revision>
|
|
</RevisionHistory>
|
|
<InitialReleaseDate>2024-03-29</InitialReleaseDate>
|
|
<CurrentReleaseDate>2024-03-29</CurrentReleaseDate>
|
|
<Generator>
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
|
<Date>2024-03-29</Date>
|
|
</Generator>
|
|
</DocumentTracking>
|
|
<DocumentNotes>
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">LibRaw security update</Note>
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for LibRaw is now available for openEuler-22.03-LTS-SP3.</Note>
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">LibRaw is a library for reading RAW files from digital photo cameras (CRW/CR2, NEF, RAF, etc, virtually all RAW formats are supported).It pays special attention to correct retrieval of data required for subsequent RAW conversion.The library is intended for embedding in RAW converters, data analyzers, and other programs using RAW files as the initial data.
|
|
|
|
Security Fix(es):
|
|
|
|
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.(CVE-2021-32142)</Note>
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for LibRaw is now available for openEuler-22.03-LTS-SP3.
|
|
|
|
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">LibRaw</Note>
|
|
</DocumentNotes>
|
|
<DocumentReferences>
|
|
<Reference Type="Self">
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1339</URL>
|
|
</Reference>
|
|
<Reference Type="openEuler CVE">
|
|
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2021-32142</URL>
|
|
</Reference>
|
|
<Reference Type="Other">
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2021-32142</URL>
|
|
</Reference>
|
|
</DocumentReferences>
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
|
<Branch Type="Product Name" Name="openEuler">
|
|
<FullProductName ProductID="openEuler-22.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">openEuler-22.03-LTS-SP3</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="aarch64">
|
|
<FullProductName ProductID="LibRaw-debuginfo-0.20.2-7" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">LibRaw-debuginfo-0.20.2-7.oe2203sp3.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="LibRaw-devel-0.20.2-7" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">LibRaw-devel-0.20.2-7.oe2203sp3.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="LibRaw-0.20.2-7" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">LibRaw-0.20.2-7.oe2203sp3.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="LibRaw-debugsource-0.20.2-7" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">LibRaw-debugsource-0.20.2-7.oe2203sp3.aarch64.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="src">
|
|
<FullProductName ProductID="LibRaw-0.20.2-7" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">LibRaw-0.20.2-7.oe2203sp3.src.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="x86_64">
|
|
<FullProductName ProductID="LibRaw-devel-0.20.2-7" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">LibRaw-devel-0.20.2-7.oe2203sp3.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="LibRaw-debuginfo-0.20.2-7" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">LibRaw-debuginfo-0.20.2-7.oe2203sp3.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="LibRaw-0.20.2-7" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">LibRaw-0.20.2-7.oe2203sp3.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="LibRaw-debugsource-0.20.2-7" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">LibRaw-debugsource-0.20.2-7.oe2203sp3.x86_64.rpm</FullProductName>
|
|
</Branch>
|
|
</ProductTree>
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2024-03-29</ReleaseDate>
|
|
<CVE>CVE-2021-32142</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-22.03-LTS-SP3</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>High</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>7.8</BaseScore>
|
|
<Vector>AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>LibRaw security update</Description>
|
|
<DATE>2024-03-29</DATE>
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1339</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
</cvrfdoc> |