PT-2023-3275 · Libraw+8 · Libraw+8

Daisypoop · Published 2023-05-15 · Updated 2025-03-20 · CVE-2023-1729

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibRaw (affected versions not specified)

Description The issue is related to a heap-buffer-overflow in the raw2image ex() function of the LibRaw library, which is used for image processing. This overflow can be caused by a maliciously crafted file, potentially leading to an application crash. The exploitation of this issue may allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ALSA-2024:2137

BDU:2023-03406

CVE-2023-1729

DLA-3433-1

DSA-5412-1

INFSA-2024_2137

OESA-2023-1280

OPENSUSE-SU-2024:12901-1

RHSA-2024:2137

RHSA-2024_2137

SUSE-SU-2023:2194-1

SUSE-SU-2023:2195-1

SUSE-SU-2023:2196-1

SUSE-SU-2023_2194-1

SUSE-SU-2023_2196-1

USN-6137-1

USN-7266-1

Affected Products

Almalinux

Astra Linux

Libraw

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 62

• 🔥 https://github.com/LibRaw/LibRaw/issues/557 · Exploit
• https://security.gentoo.org/glsa/202312-08 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22628 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7266-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-2137.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E5ZJ3UBTJBZHNPJQFOSGM5L7WAHHE2GY · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35533 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32142 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AGZ6XF5WTPJ4GLXQ62JVRDZSVSJHXNQU · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2196-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:2137 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-0691 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-2137.html · Vendor Advisory