There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade clutter-docUpgrade gnome-menusUpgrade vala-develUpgrade valaUpgrade baobabUpgrade mozjs60Upgrade accountsservice-develUpgrade clutterUpgrade gjs-develUpgrade gnome-menus-develUpgrade mozjs52Upgrade mozjs52-develUpgrade gnome-tweaksUpgrade mozjs60-develUpgrade clutter-devel | May 4, 2022 | Dec 21, 2018 |
| Centos_linux | — | Upgrade gnome-control-centerUpgrade evince-nautilusUpgrade gnome-settings-daemonUpgrade gtk3-tests-debuginfoUpgrade libxslt-debuginfoUpgrade gdm-debugsourceUpgrade libvncserver-debugsourceUpgrade gtk3-devel-debuginfoUpgrade gnome-software-debuginfoUpgrade gnome-terminal-nautilus-debuginfoUpgrade nautilus-extensionsUpgrade gvfs-gphoto2-debuginfoUpgrade gnome-software-editor-debuginfoUpgrade gnome-settings-daemon-debugsourceUpgrade gvfs-goaUpgrade gnome-remote-desktopUpgrade gnome-control-center-debuginfoUpgrade gnome-tweaksUpgrade gvfsUpgrade accountsservice-debuginfoUpgrade clutter-debuginfoUpgrade gvfs-develUpgrade gnome-boxes-debuginfoUpgrade gtk3-develUpgrade LibRaw-debugsourceUpgrade clutter-debugsourceUpgrade vinagreUpgrade gnome-terminal-nautilusUpgrade LibRaw-debuginfoUpgrade gvfs-afpUpgrade accountsservice-libsUpgrade gnome-session-debugsourceUpgrade nautilus-extensions-debuginfoUpgrade gvfs-debugsourceUpgrade gnome-remote-desktop-debuginfoUpgrade gnome-session-wayland-sessionUpgrade gnome-terminal-debuginfoUpgrade gvfs-debuginfoUpgrade gvfs-afcUpgrade gnome-online-accounts-debuginfoUpgrade evince-browser-pluginUpgrade libxslt-develUpgrade gnome-terminal-debugsourceUpgrade evince-libsUpgrade nautilusUpgrade gtk3Upgrade gnome-online-accountsUpgrade gjsUpgrade mozjs52-devel-debuginfoUpgrade evince-debugsourceUpgrade mozjs60-debuginfoUpgrade gvfs-mtpUpgrade appstream-dataUpgrade gnome-session-debuginfoUpgrade gvfs-client-debuginfoUpgrade gnome-sessionUpgrade mozjs60Upgrade gvfs-smbUpgrade libvncserverUpgrade gdm-debuginfoUpgrade gtk-update-icon-cacheUpgrade libvncserver-debuginfoUpgrade mozjs60-debugsourceUpgrade gvfs-fuse-debuginfoUpgrade gvfs-fuseUpgrade gtk3-immodule-xim-debuginfoUpgrade gnome-shell-debugsourceUpgrade gsettings-desktop-schemasUpgrade gvfs-smb-debuginfoUpgrade gvfs-mtp-debuginfoUpgrade evince-libs-debuginfoUpgrade gvfs-archive-debuginfoUpgrade mozjs52-debugsourceUpgrade gvfs-clientUpgrade gnome-online-accounts-develUpgrade gnome-terminalUpgrade gnome-shell-debuginfoUpgrade gtk3-debuginfoUpgrade LibRaw-samples-debuginfoUpgrade gnome-remote-desktop-debugsourceUpgrade baobab-debugsourceUpgrade gnome-software-editorUpgrade evinceUpgrade gnome-control-center-filesystemUpgrade gvfs-afc-debuginfoUpgrade gjs-debugsourceUpgrade gjs-tests-debuginfoUpgrade accountsserviceUpgrade libxslt-debugsourceUpgrade gtk3-immodule-ximUpgrade mutter-debugsourceUpgrade gnome-software-debugsourceUpgrade evince-debuginfoUpgrade gnome-menusUpgrade gtk3-immodules-debuginfoUpgrade evince-browser-plugin-debuginfoUpgrade gnome-settings-daemon-debuginfoUpgrade gdmUpgrade gnome-boxesUpgrade gtk3-debugsourceUpgrade gvfs-archiveUpgrade gnome-boxes-debugsourceUpgrade gvfs-afp-debuginfoUpgrade accountsservice-debugsourceUpgrade gnome-menus-debuginfoUpgrade mozjs52-debuginfoUpgrade vinagre-debugsourceUpgrade gvfs-goa-debuginfoUpgrade baobab-debuginfoUpgrade gnome-softwareUpgrade mutterUpgrade gnome-online-accounts-debugsourceUpgrade vinagre-debuginfoUpgrade clutterUpgrade mutter-debuginfoUpgrade clutter-tests-debuginfoUpgrade evince-nautilus-debuginfoUpgrade gvfs-gphoto2Upgrade nautilus-debugsourceUpgrade mutter-tests-debuginfoUpgrade baobabUpgrade accountsservice-libs-debuginfoUpgrade gtk-update-icon-cache-debuginfoUpgrade mozjs52Upgrade libxsltUpgrade gjs-debuginfoUpgrade LibRawUpgrade gnome-session-xsessionUpgrade nautilus-debuginfoUpgrade gnome-control-center-debugsourceUpgrade gnome-shellUpgrade gsettings-desktop-schemas-develUpgrade gnome-menus-debugsource | Apr 29, 2020 | Dec 21, 2018 |
| Debian | — | Upgrade libraw | Jul 30, 2024 | Dec 21, 2018 |
| Oracle_linux | — | Upgrade gnome-software-editorUpgrade gtk-update-icon-cacheUpgrade gnome-online-accountsUpgrade mozjs60Upgrade LibRaw-develUpgrade gnome-sessionUpgrade gnome-session-xsessionUpgrade nautilusUpgrade evince-nautilusUpgrade gnome-terminal-nautilusUpgrade gnome-settings-daemonUpgrade evince-browser-pluginUpgrade gnome-boxesUpgrade clutter-develUpgrade gnome-shellUpgrade gjsUpgrade gnome-control-centerUpgrade gnome-remote-desktopUpgrade accountsservice-libsUpgrade libvncserverUpgrade libxslt-develUpgrade mozjs52-develUpgrade nautilus-extensionsUpgrade gtk3-develUpgrade valaUpgrade evince-libsUpgrade gnome-menus-develUpgrade mozjs60-develUpgrade appstream-dataUpgrade LibRawUpgrade gnome-control-center-filesystemUpgrade mutter-develUpgrade gnome-menusUpgrade gtk3Upgrade gnome-session-wayland-sessionUpgrade gnome-softwareUpgrade gdmUpgrade libxsltUpgrade evinceUpgrade libvncserver-develUpgrade gnome-terminalUpgrade gnome-online-accounts-develUpgrade vala-develUpgrade mutterUpgrade gtk3-immodule-ximUpgrade gnome-tweaksUpgrade clutterUpgrade nautilus-develUpgrade gjs-develUpgrade mozjs52Upgrade gsettings-desktop-schemas-develUpgrade clutter-docUpgrade gsettings-desktop-schemasUpgrade accountsservice-develUpgrade accountsserviceUpgrade vinagre | Jul 22, 2024 | Dec 18, 2018 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Dec 21, 2018 |
| Redhat_linux | — | Upgrade gnome-sessionUpgrade gvfs-goaUpgrade libvncserver-debugsourceUpgrade mozjs60-debugsourceUpgrade gnome-control-center-filesystemUpgrade gjs-debuginfoUpgrade gnome-control-centerUpgrade gnome-control-center-debugsourceUpgrade mozjs60-develUpgrade LibRaw-debugsourceUpgrade evince-nautilusUpgrade accountsservice-debuginfoUpgrade LibRawUpgrade gvfs-gphoto2-debuginfoUpgrade gnome-terminal-debuginfoUpgrade gjs-debugsourceUpgrade gtk3-immodule-ximUpgrade gnome-software-debugsourceUpgrade gvfs-afpUpgrade gtk-update-icon-cacheUpgrade gjsUpgrade clutterUpgrade mozjs60Upgrade accountsservice-libsUpgrade gnome-software-editor-debuginfoUpgrade gvfs-smbUpgrade clutter-develUpgrade gnome-settings-daemonUpgrade gnome-terminal-debugsourceUpgrade baobabUpgrade gvfs-goa-debuginfoUpgrade gsettings-desktop-schemas-develUpgrade gvfs-debuginfoUpgrade gvfs-client-debuginfoUpgrade gnome-remote-desktop-debuginfoUpgrade accountsserviceUpgrade evince-nautilus-debuginfoUpgrade evince-debuginfoUpgrade gnome-menus-debuginfoUpgrade gnome-terminal-nautilus-debuginfoUpgrade libxslt-develUpgrade gvfs-afcUpgrade LibRaw-debuginfoUpgrade mozjs52-develUpgrade clutter-docUpgrade gtk3Upgrade mozjs52-devel-debuginfoUpgrade gtk3-debugsourceUpgrade mutter-debuginfoUpgrade gnome-settings-daemon-debugsourceUpgrade gdm-debuginfoUpgrade clutter-debuginfoUpgrade mutter-tests-debuginfoUpgrade nautilus-debugsourceUpgrade gnome-shell-debuginfoUpgrade gnome-session-wayland-sessionUpgrade clutter-debugsourceUpgrade vala-debuginfoUpgrade gnome-menus-debugsourceUpgrade libxslt-debuginfoUpgrade clutter-tests-debuginfoUpgrade mutterUpgrade mozjs52-debugsourceUpgrade gnome-online-accounts-debuginfoUpgrade nautilus-extensionsUpgrade gnome-online-accounts-debugsourceUpgrade gtk3-devel-debuginfoUpgrade gvfs-clientUpgrade vala-develUpgrade vinagre-debugsourceUpgrade gnome-session-xsessionUpgrade gnome-session-debugsourceUpgrade gvfs-fuse-debuginfoUpgrade gnome-remote-desktop-debugsourceUpgrade evince-libs-debuginfoUpgrade gnome-boxes-debugsourceUpgrade gnome-tweaksUpgrade nautilusUpgrade gtk3-immodule-xim-debuginfoUpgrade gnome-software-editorUpgrade vinagreUpgrade gjs-tests-debuginfoUpgrade libvncserver-debuginfoUpgrade gnome-shell-debugsourceUpgrade gjs-develUpgrade gnome-control-center-debuginfoUpgrade gnome-boxes-debuginfoUpgrade mozjs52Upgrade baobab-debugsourceUpgrade vinagre-debuginfoUpgrade gvfs-afp-debuginfoUpgrade gvfs-smb-debuginfoUpgrade gvfs-mtpUpgrade evinceUpgrade nautilus-develUpgrade gtk-update-icon-cache-debuginfoUpgrade accountsservice-libs-debuginfoUpgrade valaUpgrade baobab-debuginfoUpgrade libxsltUpgrade gtk3-immodules-debuginfoUpgrade gnome-settings-daemon-debuginfoUpgrade gvfs-archiveUpgrade gtk3-develUpgrade gnome-session-debuginfoUpgrade mozjs52-debuginfoUpgrade gsettings-desktop-schemasUpgrade gnome-boxesUpgrade gtk3-tests-debuginfoUpgrade gnome-software-debuginfoUpgrade nautilus-debuginfoUpgrade nautilus-extensions-debuginfoUpgrade mutter-develUpgrade gnome-menusUpgrade gdmUpgrade LibRaw-develUpgrade libxslt-debugsourceUpgrade gnome-menus-develUpgrade gtk3-debuginfoUpgrade mutter-debugsourceUpgrade gnome-online-accountsUpgrade libvncserver-develUpgrade gnome-softwareUpgrade gvfs-develUpgrade gvfs-mtp-debuginfoUpgrade accountsservice-debugsourceUpgrade evince-debugsourceUpgrade accountsservice-develUpgrade appstream-dataUpgrade gnome-online-accounts-develUpgrade gnome-remote-desktopUpgrade gnome-terminal-nautilusUpgrade gvfs-fuseUpgrade gvfsUpgrade evince-browser-pluginUpgrade gvfs-gphoto2Upgrade gdm-debugsourceUpgrade vala-debugsourceUpgrade valadoc-debuginfoUpgrade libvncserverUpgrade evince-browser-plugin-debuginfoUpgrade gvfs-debugsourceUpgrade mozjs60-debuginfoUpgrade gnome-shellUpgrade gvfs-afc-debuginfoUpgrade gnome-terminalUpgrade evince-libsUpgrade gvfs-archive-debuginfoUpgrade LibRaw-samples-debuginfo | Apr 29, 2020 | Dec 21, 2018 |
| Rocky_linux | — | Upgrade clutter-develUpgrade mozjs60-develUpgrade mozjs52Upgrade mozjs60-debuginfoUpgrade mozjs52-devel-debuginfoUpgrade mozjs52-develUpgrade clutterUpgrade gnome-menus-develUpgrade mozjs52-debugsourceUpgrade gnome-menus-debugsourceUpgrade mozjs60Upgrade gnome-menusUpgrade clutter-debugsourceUpgrade baobab-debuginfoUpgrade mozjs52-debuginfoUpgrade clutter-docUpgrade gnome-menus-debuginfoUpgrade clutter-debuginfoUpgrade mozjs60-debugsourceUpgrade baobabUpgrade baobab-debugsource | Mar 12, 2024 | Dec 21, 2018 |
| Suse | — | Upgrade libraw-toolsUpgrade libraw16Upgrade libraw-develUpgrade libraw-devel-static | Jan 31, 2019 | Dec 21, 2018 |
| Ubuntu | — | Upgrade libraw15Upgrade libraw16 | May 22, 2019 | Dec 21, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub