CVE-2013-1438

Updated libraw packages fix security vulnerabilities:

It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, applications linked against LibRaw could be made to crash, resulting in a denial of service (CVE-2013-1438, CVE-2013-1439).

Updated libkdcraw packages fix libraw security vulnerabilities:

It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, applications linked against LibRaw could be made to crash, resulting in a denial of service (CVE-2013-1438, CVE-2013-1439).

Due to flaws in the embedded copy of LibRaw in dcraw and ufraw, corrupt input files might trigger a division by zero, an infinite loop, or a null pointer dereference (CVE-2013-1438).

The dcraw and ufraw packages have been updated to their newest versions and patched to fix the flaws in the embedded LibRaw library. They have also been patched to use the more secure lcms2 color management library, rather than the unmaintained lcms library.

Updated darktable package fixes security vulnerabilities:

Darktable before version 1.2.3 contains an embedded copy of LibRaw that incorrectly handled photo files. If a user was tricked into processing a specially crafted photo file, darktable could be made to crash, resulting in a denial of service (CVE-2013-1438, CVE-2013-1439).

Due to flaws in the embedded copy of libDCR, a fork of dcraw.c, in the embedded copy of CxImage, opening a specially crafted photo file could trigger a division by zero, an infinite loop, or a null pointer dereference, resulting in a denial of service (CVE-2013-1438).

This update fixes those flaws.

XBMC is also updated to a newer bugfix-only release, version 12.3. It contains fixes to various issues, including:

• several PVR related bugs
• memory leaks
• audio channel mapping
• possible crash on progress dialog and more.

Additionally, this update fixes a compatibility issue on Mageia 4 affecting AC-3 transcoding, which prevented, for example, multichannel playback of AAC 5.1 files over S/PDIF or stereo-only HDMI devices.

The PVR addons have also been updated.

Due to flaws in the embedded copy of dcraw in rawtherapee, corrupt input files might trigger a division by zero, an infinite loop, or a null pointer dereference (CVE-2013-1438).

Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.