CVE-2017-16909

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An error related to the "LibRaw::panasonic_load_raw()" function (dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	LibRaw	Prior to 0.18.6

References

https://github.com/LibRaw/LibRaw/blob/master/Changelog.txtRelease Notes
https://github.com/LibRaw/LibRaw/commit/f1394822a0152ceed77815eafa5cac4e8baab10aPatch
https://secuniaresearch.flexerasoftware.com/advisories/76000/Third Party Advisory
https://secuniaresearch.flexerasoftware.com/secunia_research/2017-19/Third Party Advisory
https://usn.ubuntu.com/3615-1/Third Party Advisory
https://github.com/LibRaw/LibRaw/blob/master/Changelog.txtRelease Notes
https://github.com/LibRaw/LibRaw/commit/f1394822a0152ceed77815eafa5cac4e8baab10aPatch
https://secuniaresearch.flexerasoftware.com/advisories/76000/Third Party Advisory
https://secuniaresearch.flexerasoftware.com/secunia_research/2017-19/Third Party Advisory
https://usn.ubuntu.com/3615-1/Third Party Advisory

Timeline

Published: Dec 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-16915.4IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to c CVE-2017-169106.5An error within the "LibRaw::xtrans_interpolate()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited CVE-2017-169114.7The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses.CVE-2017-169125.9The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to c CVE-2017-169135.9The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when hand CVE-2017-169145.9The "stub_send_ret_submit()" function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107 a CVE-2017-169195.4MapOS 3.1.11 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in /clientes/visualizar, which allows remote attackers to inj CVE-2017-16927.8IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level priv CVE-2017-169209.8v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which CVE-2017-169218.8In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who i CVE-2017-169225.3In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and ret CVE-2017-169238.8Command Injection vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01, Ac9 ac9_kf_V15.03.05.19(6318_