Every CVE Search/ Get API key

CVE-2018-19567

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers...

5.5 MediumFix available

CVE-2018-19567 is a medium vulnerability (CVSS 5.5) in Dcraw Project Dcraw, published November 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in dcraw 9.28.0-6.1.mga8.

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.92%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Record
CVE-2018-19567
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Record
CVE-2018-19567
Updated
2026-11-02
EUVDEUVD-2018-11256 No score

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Record
EUVD-2018-11256
Updated
2026-11-03
GitHub AdvisoriesGHSA-9qgh-5hw9-p93q 5.5

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers...

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Record
GHSA-9qgh-5hw9-p93q
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 5.5

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Record
CVE-2018-19567
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-19567 5.5

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Record
DEBIAN-CVE-2018-19567
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2018-19567 5.5

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.

Record
UBUNTU-CVE-2018-19567
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2022-0160 No score

Updated dcraw packages fix security vulnerability

A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. (CVE-2018-19565)

A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. (CVE-2018-19566)

A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. (CVE-2018-19567)

A floating point exception in kodak_radc_load_raw in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. (CVE-2018-19568)

A boundary error within the "quicktake_100_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to cause a stack-based buffer overflow and subsequently cause a crash. (CVE-2018-5805)

An error within the "leaf_hdr_load_raw()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.8 can be exploited to trigger a NULL pointer dereference. (CVE-2018-5806)

There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary code may be executed in the victim's system. (CVE-2021-3624)

Record
MGASA-2022-0160
Updated
2026-11-02
OSVSUSE-SU-2022:1277-1 No score

Security update for dcraw

This update for dcraw fixes the following issues:

  • CVE-2017-13735: Fixed a denial of service issue due to a floating point exception (bsc#1056170).
  • CVE-2017-14608: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1063798).
  • CVE-2018-19655: Fixed a buffer overflow that could lead to an application crash (bsc#1117896).
  • CVE-2018-5801: Fixed an invalid memory access that could lead to denial of service (bsc#1084690).
  • CVE-2018-5805: Fixed a buffer overflow that could lead to an application crash (bsc#1097973).
  • CVE-2018-5806: Fixed an invalid memory access that could lead to denial of service (bsc#1097974).
  • CVE-2018-19565: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117622).
  • CVE-2018-19566: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117517).
  • CVE-2018-19567: Fixed a denial of service issue due to a floating point exception (bsc#1117512).
  • CVE-2018-19568: Fixed a denial of service issue due to a floating point exception (bsc#1117436).
  • CVE-2021-3624: Fixed a buffer overflow that could lead to code execution or denial of service (bsc#1189642).

Non-security fixes:

  • Updated to version 9.28.0.
Record
SUSE-SU-2022:1277-1
Updated
2026-11-02
OSVSUSE-SU-2022:1749-1 No score

Security update for dcraw

This update for dcraw fixes the following issues:

  • CVE-2017-13735: Fixed a denial of service issue due to a floating point exception (bsc#1056170).
  • CVE-2017-14608: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1063798).
  • CVE-2018-19655: Fixed a buffer overflow that could lead to an application crash (bsc#1117896).
  • CVE-2018-5801: Fixed an invalid memory access that could lead to denial of service (bsc#1084690).
  • CVE-2018-5805: Fixed a buffer overflow that could lead to an application crash (bsc#1097973).
  • CVE-2018-5806: Fixed an invalid memory access that could lead to denial of service (bsc#1097974).
  • CVE-2018-19565: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117622).
  • CVE-2018-19566: Fixed an invalid memory access that could lead to information disclosure or denial of service (bsc#1117517).
  • CVE-2018-19567: Fixed a denial of service issue due to a floating point exception (bsc#1117512).
  • CVE-2018-19568: Fixed a denial of service issue due to a floating point exception (bsc#1117436).
  • CVE-2021-3624: Fixed a buffer overflow that could lead to code execution or denial of service (bsc#1189642).

Non-security fixes:

  • Updated to version 9.28.0.
Record
SUSE-SU-2022:1749-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dcraw
Debian:12
 All versions, plus listed versions
9.28-39.28-3.19.28-49.28-59.28-5.19.28-69.28-79.28-8
 None known
dcraw
Debian:13
 All versions, plus listed versions
9.28-8
 None known
dcraw
Debian:14
 All versions, plus listed versions
9.28-8
 None known
dcraw
Mageia:8
 before 9.28.0-6.1.mga8
9.28.0-6.1.mga8
dcraw
openSUSE:Leap 15.3
 before 9.28.0-150000.3.3.1
9.28.0-150000.3.3.1
dcraw
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 9.28.0-3.3.1
9.28.0-3.3.1
dcraw
SUSE:Linux Enterprise Workstation Extension 12 SP5
 before 9.28.0-3.3.1
9.28.0-3.3.1
dcraw
Ubuntu:16.04:LTS
 All versions, plus listed versions
9.21-0.2
 None known
dcraw
Ubuntu:18.04:LTS
 All versions, plus listed versions
9.27-1ubuntu1
 None known
dcraw
Ubuntu:20.04:LTS
 All versions, plus listed versions
9.28-2
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
dcraw
Ubuntu:22.04:LTS
 All versions, plus listed versions
9.28-29.28-3
 None known
dcraw
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.28-39.28-3.1ubuntu19.28-5ubuntu1
 None known
dcraw
Ubuntu:25.10
 All versions, plus listed versions
9.28-8
 None known
dcraw
Ubuntu:26.10
 All versions, plus listed versions
9.28-8build1
 None known
dcraw
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.28-89.28-8build1
 None known

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open