PT-2021-7867 · Libraw+8 · Libraw+8
Gtt1995
·
Published
2021-04-12
·
Updated
2025-02-13
·
CVE-2021-32142
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
LibRaw version 0.20.0
Description
The issue is related to a buffer overflow in the
LibRaw buffer datastream::gets function, located in the libraw datastream.cpp component of the LibRaw image processing library. This allows an attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted file. The vulnerability can be exploited to escalate privileges.Recommendations
For LibRaw version 0.20.0, consider disabling the
LibRaw buffer datastream::gets function as a temporary workaround until a patch is available. Restrict access to the libraw datastream.cpp component to minimize the risk of exploitation. Avoid using the gets function in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Stack Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Libraw
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu