Vulnetix
Try Vulnetix Request Demo
CVE-2017-6887 PUBLISHED

A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.

EPSS 0.47% · 64.4th percentile

Risk Scores

EPSS Score
0.47%
64.4th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSdarktable3.8.1-2, 0, 3.6.0-0ubuntu1
Ubuntu:25.10kodi2:21.2+dfsg-1build2, 2:21.2+dfsg-4build1, 2:21.2+dfsg-4
Ubuntu:25.10rawtherapee0, 5.11-2build2
Ubuntu:20.04:LTSrawtherapee5.6-1, 5.7-1, 0
Ubuntu:18.04:LTSrawtherapee5.2-1, 5.3-1, 0
Ubuntu:22.04:LTSexactimage1.0.2-8build2, 1.0.2-8build1, 1.0.2-8
Ubuntu:18.04:LTSdcraw0, 9.27-1ubuntu1
Ubuntu:24.04:LTSexactimage1.0.2-11build7, 1.0.2-11build4, 0
Ubuntu:16.04:LTSufraw0.20-3build1, 0
Ubuntu:16.04:LTSrawtherapee4.2-2build1, 0, 4.2-4
Ubuntu:16.04:LTSkodi0, 15.2+dfsg1-3, 15.2+dfsg1-3ubuntu1
Ubuntu:25.10darktable5.0.1-0ubuntu1, 0, 5.0.1-1
Ubuntu:25.10exactimage0, 1.2.1-2
Ubuntu:22.04:LTSkodi*, 2:19.3+dfsg1-1build2, 2:19.1+dfsg2-2
Ubuntu:24.04:LTSrawtherapee5.9-1build1, 0, 5.9-2
Ubuntu:16.04:LTSexactimage0, 0.9.1-9build1, 0.9.1-11
Ubuntu:18.04:LTSkodi2:17.3+dfsg1-3, *, *
Ubuntu:24.04:LTSdcraw0, 9.28-3.1ubuntu1, 9.28-5ubuntu1
Ubuntu:22.04:LTSdcraw9.28-3, 0, 9.28-2
Ubuntu:20.04:LTSdcraw9.28-2, 0

…and 14 more

Timeline

References

Open in Interactive Console →