PT-2022-6944 · Libraw+4 · Libraw+4

Girlelecta · Published 2022-09-01 · Updated 2025-02-13 · CVE-2020-35532

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LibRaw (affected versions not specified)

Description The issue is related to an out-of-bounds read that can occur within the simple decode row() function, specifically in the x3f utils patched.cpp component of the LibRaw image processing library. This can be triggered by an image with a large row stride field, potentially allowing an attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2023-5465

BDU:2023-05698

CVE-2020-35532

DLA-3113-1

ROSA-SA-2024-2474

USN-5715-1

USN-7266-1

Affected Products

Alt Linux

Astra Linux

Libraw

Linuxmint

Ubuntu

References · 30

• 🔥 https://github.com/LibRaw/LibRaw/issues/271 · Exploit
• https://github.com/LibRaw/LibRaw/commit/5ab45b085898e379fedc6b113e2e82a890602b1e · Patch
• https://ubuntu.com/security/CVE-2020-15503 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5715-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35533 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35532 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35532 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05698 · Security Note
• https://ubuntu.com/security/notices/USN-5715-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7266-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-35532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35530 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35532 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35532 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35532 · Vendor Advisory