PT-2020-6833 · Libraw+9 · Libraw+9
Published
2020-07-02
·
Updated
2024-06-15
·
CVE-2020-15503
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
LibRaw versions prior to 0.20-RC1
Description
The issue is related to the absence of a thumbnail size range check in the LibRaw library for image processing. This affects components such as decoders/unpack thumb.cpp, postprocessing/mem image.cpp, and utils/thumb utils.cpp. Exploitation of this issue can allow a remote attacker to cause a denial of service. For example, the
malloc function is called with sizeof(libraw processed image t)+T.tlength without validating T.tlength.Recommendations
For versions prior to 0.20-RC1, update to version 0.20-RC1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the affected components, such as decoders/unpack thumb.cpp, postprocessing/mem image.cpp, and utils/thumb utils.cpp, until a patch is available. Avoid using unvalidated input for
T.tlength in the affected malloc call until the issue is resolved.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Libraw
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu