LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade vte-profileUpgrade PackageKit-command-not-foundUpgrade pygobject3-develUpgrade pipewire0.2-develUpgrade dleyna-rendererUpgrade PackageKit-gstreamer-pluginUpgrade pipewire0.2-libsUpgrade libsoup-develUpgrade potraceUpgrade webrtc-audio-processingUpgrade mutter-develUpgrade vte291Upgrade pipewire-docUpgrade python3-gobjectUpgrade pipewire-utilsUpgrade python3-gobject-baseUpgrade PackageKitUpgrade pipewire-develUpgrade gvfsUpgrade nautilus-develUpgrade PackageKit-glib-develUpgrade gtk-docUpgrade nautilusUpgrade tracker-develUpgrade vte291-develUpgrade xdg-desktop-portal-gtkUpgrade PackageKit-cronUpgrade frei0r-develUpgrade frei0r-pluginsUpgrade pipewireUpgrade trackerUpgrade PackageKit-gtk3-moduleUpgrade libsoupUpgrade pipewire-libsUpgrade frei0r-plugins-opencvUpgrade LibRaw-develUpgrade PackageKit-glibUpgrade gnome-remote-desktop | May 4, 2022 | Jul 2, 2020 |
| Alpine Linux | — | Upgrade libraw | Aug 7, 2020 | Jul 2, 2020 |
| Centos_linux | — | Upgrade gvfs-mtpUpgrade pipewire-develUpgrade potrace-debugsourceUpgrade gdm-debuginfoUpgrade pipewire0.2-libs-debuginfoUpgrade gdmUpgrade pipewire-docUpgrade gnome-shell-extension-horizontal-workspacesUpgrade potrace-debuginfoUpgrade gnome-shell-extension-panel-favoritesUpgrade gtk3-immodule-xim-debuginfoUpgrade gnome-terminal-debuginfoUpgrade frei0r-pluginsUpgrade gvfs-afpUpgrade mutter-debuginfoUpgrade webkit2gtk3-jsc-devel-debuginfoUpgrade PackageKitUpgrade gtk-update-icon-cache-debuginfoUpgrade gnome-shell-extension-native-window-placementUpgrade gtk-update-icon-cacheUpgrade gnome-shell-extension-screenshot-window-sizerUpgrade pipewire-libsUpgrade LibRaw-samples-debuginfoUpgrade gnome-remote-desktop-debugsourceUpgrade gnome-shell-extension-launch-new-instanceUpgrade webrtc-audio-processingUpgrade xdg-desktop-portal-debugsourceUpgrade trackerUpgrade vte-profileUpgrade PackageKit-debuginfoUpgrade gvfs-clientUpgrade webkit2gtk3-jscUpgrade python3-gobject-base-debuginfoUpgrade gdm-debugsourceUpgrade gnome-shell-extension-places-menuUpgrade pipewire-libs-debuginfoUpgrade gtk3-tests-debuginfoUpgrade gtk3-devel-debuginfoUpgrade python3-gobject-debuginfoUpgrade webkit2gtk3-jsc-debuginfoUpgrade gnome-shell-extension-desktop-iconsUpgrade webkit2gtk3-devel-debuginfoUpgrade gvfs-debugsourceUpgrade gvfs-archive-debuginfoUpgrade PackageKit-cronUpgrade potraceUpgrade gnome-control-center-debugsourceUpgrade gnome-control-center-filesystemUpgrade vte291-devel-debuginfoUpgrade tracker-debuginfoUpgrade gnome-shell-extension-no-hot-cornerUpgrade pipewire0.2-libsUpgrade frei0r-plugins-opencvUpgrade webkit2gtk3-jsc-develUpgrade gnome-shell-extension-window-grouperUpgrade gnome-session-xsessionUpgrade webkit2gtk3-debugsourceUpgrade gnome-photos-testsUpgrade gnome-terminalUpgrade gvfs-fuse-debuginfoUpgrade nautilusUpgrade gnome-shell-extension-user-themeUpgrade gnome-shell-extension-windowsNavigatorUpgrade gtk3-immodules-debuginfoUpgrade gvfs-afc-debuginfoUpgrade gvfs-debuginfoUpgrade mutter-debugsourceUpgrade gnome-session-debuginfoUpgrade gnome-shellUpgrade frei0r-plugins-debuginfoUpgrade gtk3Upgrade libsoup-debugsourceUpgrade webrtc-audio-processing-debuginfoUpgrade gtk3-develUpgrade gtk3-debugsourceUpgrade gnome-classic-sessionUpgrade gnome-settings-daemonUpgrade gnome-terminal-nautilusUpgrade gnome-remote-desktopUpgrade pipewire-debuginfoUpgrade vte291Upgrade pipewire-alsa-debuginfoUpgrade gvfs-develUpgrade gnome-terminal-debugsourceUpgrade libsoup-debuginfoUpgrade gtk3-debuginfoUpgrade nautilus-debuginfoUpgrade python3-gobjectUpgrade PackageKit-gtk3-moduleUpgrade gnome-shell-extension-auto-move-windowsUpgrade gvfs-archiveUpgrade gvfs-afcUpgrade gvfs-gphoto2-debuginfoUpgrade gnome-shell-extension-disable-screenshieldUpgrade gnome-settings-daemon-debuginfoUpgrade gnome-shell-extension-systemMonitorUpgrade gsettings-desktop-schemas-develUpgrade dleyna-rendererUpgrade gvfs-client-debuginfoUpgrade gnome-terminal-nautilus-debuginfoUpgrade gnome-shell-extension-top-iconsUpgrade tracker-debugsourceUpgrade gnome-shell-extension-apps-menuUpgrade PackageKit-gtk3-module-debuginfoUpgrade gnome-control-centerUpgrade frei0r-plugins-opencv-debuginfoUpgrade gvfs-goa-debuginfoUpgrade xdg-desktop-portal-gtkUpgrade gvfs-smbUpgrade gvfs-gphoto2Upgrade PackageKit-gstreamer-pluginUpgrade xdg-desktop-portal-debuginfoUpgrade PackageKit-command-not-found-debuginfoUpgrade LibRaw-debugsourceUpgrade gvfs-mtp-debuginfoUpgrade gnome-shell-extension-workspace-indicatorUpgrade gnome-session-debugsourceUpgrade gnome-photos-debuginfoUpgrade webrtc-audio-processing-debugsourceUpgrade vte291-debuginfoUpgrade pygobject3-debuginfoUpgrade PackageKit-gstreamer-plugin-debuginfoUpgrade PackageKit-debugsourceUpgrade pipewire-utilsUpgrade pipewire-utils-debuginfoUpgrade libsoup-develUpgrade gnome-shell-extension-commonUpgrade dleyna-renderer-debuginfoUpgrade LibRaw-debuginfoUpgrade gtk3-immodule-ximUpgrade webkit2gtk3-develUpgrade vte291-debugsourceUpgrade python3-gobject-baseUpgrade pipewire-gstreamer-debuginfoUpgrade PackageKit-glib-debuginfoUpgrade LibRawUpgrade gvfs-afp-debuginfoUpgrade gnome-shell-extension-updates-dialogUpgrade pipewire0.2-debugsourceUpgrade nautilus-extensions-debuginfoUpgrade webkit2gtk3-debuginfoUpgrade nautilus-extensionsUpgrade xdg-desktop-portal-gtk-debuginfoUpgrade gnome-remote-desktop-debuginfoUpgrade gnome-control-center-debuginfoUpgrade mutter-tests-debuginfoUpgrade mutterUpgrade gnome-photos-debugsourceUpgrade gnome-shell-extension-window-listUpgrade libsoupUpgrade gnome-shell-debuginfoUpgrade pipewire-debugsourceUpgrade PackageKit-glibUpgrade PackageKit-command-not-foundUpgrade gnome-shell-extension-drive-menuUpgrade nautilus-debugsourceUpgrade gvfs-smb-debuginfoUpgrade gsettings-desktop-schemasUpgrade gnome-settings-daemon-debugsourceUpgrade gnome-session-wayland-sessionUpgrade dleyna-renderer-debugsourceUpgrade xdg-desktop-portalUpgrade pygobject3-debugsourceUpgrade xdg-desktop-portal-gtk-debugsourceUpgrade pipewireUpgrade gvfs-fuseUpgrade webkit2gtk3Upgrade gnome-shell-debugsourceUpgrade gnome-sessionUpgrade gnome-photosUpgrade frei0r-plugins-debugsourceUpgrade pipewire0.2-develUpgrade gvfs-goaUpgrade gvfsUpgrade gnome-shell-extension-dash-to-dock | Nov 5, 2020 | Jul 2, 2020 |
| Debian | — | Upgrade libraw | Dec 2, 2022 | Jul 2, 2020 |
| Oracle_linux | — | Upgrade gnome-shell-extension-native-window-placementUpgrade gtk-docUpgrade gtk3-immodule-ximUpgrade gnome-shell-extension-workspace-indicatorUpgrade libsoupUpgrade mutter-develUpgrade vte-profileUpgrade webkit2gtk3-develUpgrade gnome-session-wayland-sessionUpgrade pipewire-utilsUpgrade libsoup-develUpgrade PackageKit-glibUpgrade gvfs-smbUpgrade pipewire-docUpgrade gdmUpgrade gnome-photos-testsUpgrade gvfs-fuseUpgrade gnome-shell-extension-systemMonitorUpgrade mutterUpgrade PackageKit-command-not-foundUpgrade gnome-shell-extension-top-iconsUpgrade PackageKit-gtk3-moduleUpgrade LibRawUpgrade python3-gobjectUpgrade gnome-shell-extension-auto-move-windowsUpgrade python3-gobject-baseUpgrade gvfs-gphoto2Upgrade pygobject3-develUpgrade gnome-shell-extension-updates-dialogUpgrade gsettings-desktop-schemas-develUpgrade gvfsUpgrade PackageKit-cronUpgrade PackageKit-gstreamer-pluginUpgrade webkit2gtk3Upgrade tracker-develUpgrade gnome-shell-extension-user-themeUpgrade potraceUpgrade gvfs-archiveUpgrade dleyna-rendererUpgrade webrtc-audio-processingUpgrade gnome-terminalUpgrade gnome-shell-extension-dash-to-dockUpgrade gnome-control-centerUpgrade gnome-shell-extension-apps-menuUpgrade nautilus-develUpgrade gnome-terminal-nautilusUpgrade gnome-shell-extension-horizontal-workspacesUpgrade gvfs-mtpUpgrade trackerUpgrade gnome-shell-extension-screenshot-window-sizerUpgrade PackageKitUpgrade gsettings-desktop-schemasUpgrade gnome-session-xsessionUpgrade pipewire-libsUpgrade gnome-shell-extension-no-hot-cornerUpgrade gvfs-goaUpgrade gnome-shellUpgrade gnome-control-center-filesystemUpgrade pipewire0.2-develUpgrade gvfs-afcUpgrade LibRaw-develUpgrade gvfs-clientUpgrade pipewireUpgrade gnome-shell-extension-window-grouperUpgrade gnome-shell-extension-launch-new-instanceUpgrade gnome-shell-extension-commonUpgrade gnome-settings-daemonUpgrade xdg-desktop-portal-gtkUpgrade webkit2gtk3-jscUpgrade gtk-update-icon-cacheUpgrade vte291-develUpgrade pipewire0.2-libsUpgrade pipewire-develUpgrade vte291Upgrade gtk3Upgrade gnome-shell-extension-window-listUpgrade gnome-classic-sessionUpgrade xdg-desktop-portalUpgrade webkit2gtk3-jsc-develUpgrade gtk3-develUpgrade gnome-shell-extension-panel-favoritesUpgrade gnome-shell-extension-drive-menuUpgrade gnome-shell-extension-disable-screenshieldUpgrade frei0r-plugins-opencvUpgrade nautilusUpgrade gnome-remote-desktopUpgrade gvfs-develUpgrade gnome-sessionUpgrade PackageKit-glib-develUpgrade gnome-shell-extension-places-menuUpgrade frei0r-develUpgrade gnome-shell-extension-desktop-iconsUpgrade gnome-photosUpgrade frei0r-pluginsUpgrade gvfs-afpUpgrade nautilus-extensionsUpgrade gnome-shell-extension-windowsNavigator | Nov 12, 2020 | Jun 22, 2020 |
| Redhat_linux | — | Upgrade gnome-shell-extension-window-listUpgrade gtk3-immodule-xim-debuginfoUpgrade gtk3-develUpgrade vte291-develUpgrade gnome-shell-debugsourceUpgrade webkit2gtk3-debugsourceUpgrade mutter-debugsourceUpgrade vte291-devel-debuginfoUpgrade libsoup-debugsourceUpgrade dleyna-renderer-debuginfoUpgrade gtk-docUpgrade pipewire-libsUpgrade gvfs-afpUpgrade gvfs-archive-debuginfoUpgrade PackageKit-command-not-foundUpgrade gdmUpgrade gdm-debugsourceUpgrade gnome-shell-extension-screenshot-window-sizerUpgrade gnome-shell-extension-windowsNavigatorUpgrade nautilus-debuginfoUpgrade nautilusUpgrade PackageKit-glib-develUpgrade gnome-shell-extension-horizontal-workspacesUpgrade gtk3-debugsourceUpgrade gvfs-mtpUpgrade frei0r-plugins-opencvUpgrade gnome-shell-extension-desktop-iconsUpgrade gnome-shell-extension-panel-favoritesUpgrade webrtc-audio-processing-debuginfoUpgrade gtk3-tests-debuginfoUpgrade gvfs-smb-debuginfoUpgrade frei0r-plugins-debuginfoUpgrade LibRaw-develUpgrade gnome-control-center-debuginfoUpgrade gnome-shell-extension-disable-screenshieldUpgrade gnome-terminal-debugsourceUpgrade trackerUpgrade gvfs-afc-debuginfoUpgrade gtk3-immodules-debuginfoUpgrade vte291-debuginfoUpgrade PackageKit-gtk3-moduleUpgrade PackageKit-cronUpgrade gtk-update-icon-cache-debuginfoUpgrade webkit2gtk3-jsc-debuginfoUpgrade gvfs-gphoto2Upgrade gsettings-desktop-schemasUpgrade gtk-update-icon-cacheUpgrade pipewire0.2-libs-debuginfoUpgrade xdg-desktop-portal-debugsourceUpgrade pipewire-alsa-debuginfoUpgrade pipewireUpgrade gvfs-mtp-debuginfoUpgrade gnome-settings-daemonUpgrade LibRaw-samples-debuginfoUpgrade gvfs-develUpgrade python3-gobject-debuginfoUpgrade pygobject3-develUpgrade gtk3-debuginfoUpgrade webkit2gtk3-jscUpgrade gnome-shell-extension-top-iconsUpgrade gnome-shellUpgrade frei0r-pluginsUpgrade gnome-shell-extension-apps-menuUpgrade libsoup-debuginfoUpgrade pipewire-utils-debuginfoUpgrade gnome-shell-extension-places-menuUpgrade gvfs-fuseUpgrade vte-profileUpgrade gnome-terminalUpgrade gnome-control-center-filesystemUpgrade gnome-classic-sessionUpgrade gvfs-archiveUpgrade gnome-terminal-nautilusUpgrade gnome-shell-extension-commonUpgrade xdg-desktop-portal-gtk-debuginfoUpgrade gnome-photos-debugsourceUpgrade gnome-shell-extension-dash-to-dockUpgrade mutter-develUpgrade webkit2gtk3-devel-debuginfoUpgrade gnome-remote-desktopUpgrade pipewire-develUpgrade gnome-session-debuginfoUpgrade potraceUpgrade gnome-shell-extension-user-themeUpgrade python3-gobject-base-debuginfoUpgrade PackageKit-glib-debuginfoUpgrade xdg-desktop-portalUpgrade PackageKitUpgrade pipewire-debuginfoUpgrade gnome-shell-extension-native-window-placementUpgrade tracker-debugsourceUpgrade python3-gobjectUpgrade gvfs-client-debuginfoUpgrade gnome-shell-extension-window-grouperUpgrade gvfs-goa-debuginfoUpgrade gnome-control-center-debugsourceUpgrade xdg-desktop-portal-debuginfoUpgrade pipewire-gstreamer-debuginfoUpgrade gvfs-debuginfoUpgrade gnome-session-xsessionUpgrade gvfs-goaUpgrade webrtc-audio-processing-debugsourceUpgrade nautilus-develUpgrade gnome-sessionUpgrade webkit2gtk3Upgrade pipewire-debugsourceUpgrade LibRaw-debugsourceUpgrade gsettings-desktop-schemas-develUpgrade mutter-tests-debuginfoUpgrade gnome-settings-daemon-debugsourceUpgrade nautilus-debugsourceUpgrade gvfsUpgrade mutter-debuginfoUpgrade nautilus-extensionsUpgrade xdg-desktop-portal-gtkUpgrade gnome-settings-daemon-debuginfoUpgrade gvfs-afp-debuginfoUpgrade frei0r-develUpgrade gnome-control-centerUpgrade vte291-debugsourceUpgrade libsoup-develUpgrade PackageKit-debugsourceUpgrade pipewire-docUpgrade PackageKit-debuginfoUpgrade PackageKit-gstreamer-plugin-debuginfoUpgrade frei0r-plugins-debugsourceUpgrade gnome-remote-desktop-debugsourceUpgrade gnome-photos-debuginfoUpgrade gvfs-gphoto2-debuginfoUpgrade potrace-debuginfoUpgrade gnome-shell-debuginfoUpgrade pygobject3-debugsourceUpgrade LibRaw-debuginfoUpgrade gnome-session-debugsourceUpgrade python3-gobject-baseUpgrade dleyna-renderer-debugsourceUpgrade gtk3Upgrade gnome-shell-extension-updates-dialogUpgrade pipewire-utilsUpgrade gnome-shell-extension-launch-new-instanceUpgrade gvfs-smbUpgrade gnome-shell-extension-drive-menuUpgrade gvfs-afcUpgrade LibRawUpgrade webkit2gtk3-jsc-devel-debuginfoNo solution existsUpgrade gdm-debuginfoUpgrade webkit2gtk3-develUpgrade nautilus-extensions-debuginfoUpgrade tracker-debuginfoUpgrade gnome-photos-testsUpgrade tracker-develUpgrade PackageKit-glibUpgrade gnome-shell-extension-auto-move-windowsUpgrade gnome-photosUpgrade webrtc-audio-processingUpgrade pipewire0.2-debugsourceUpgrade PackageKit-command-not-found-debuginfoUpgrade gnome-terminal-nautilus-debuginfoUpgrade gnome-session-wayland-sessionUpgrade gnome-shell-extension-systemMonitorUpgrade gnome-terminal-debuginfoUpgrade gnome-remote-desktop-debuginfoUpgrade gtk3-devel-debuginfoUpgrade gnome-shell-extension-no-hot-cornerUpgrade potrace-debugsourceUpgrade pipewire0.2-libsUpgrade xdg-desktop-portal-gtk-debugsourceUpgrade gtk3-immodule-ximUpgrade pipewire0.2-develUpgrade gvfs-debugsourceUpgrade gvfs-clientUpgrade vte291Upgrade gvfs-fuse-debuginfoUpgrade frei0r-plugins-opencv-debuginfoUpgrade dleyna-rendererUpgrade mutterUpgrade libsoupUpgrade webkit2gtk3-debuginfoUpgrade PackageKit-gtk3-module-debuginfoUpgrade PackageKit-gstreamer-pluginUpgrade gnome-shell-extension-workspace-indicatorUpgrade pipewire-libs-debuginfoUpgrade webkit2gtk3-jsc-develUpgrade pygobject3-debuginfo | Nov 5, 2020 | Jul 2, 2020 |
| Rocky_linux | — | Upgrade potraceUpgrade python3-gobject-baseUpgrade tracker-develUpgrade PackageKit-cronUpgrade pipewireUpgrade gtk3-immodule-xim-debuginfoUpgrade gtk-update-icon-cache-debuginfoUpgrade tracker-debugsourceUpgrade xdg-desktop-portal-gtkUpgrade PackageKit-gstreamer-plugin-debuginfoUpgrade LibRawUpgrade PackageKit-glib-debuginfoUpgrade PackageKit-debugsourceUpgrade tracker-debuginfoUpgrade PackageKit-gtk3-moduleUpgrade xdg-desktop-portal-gtk-debuginfoUpgrade dleyna-renderer-debugsourceUpgrade LibRaw-develUpgrade libsoupUpgrade PackageKit-glibUpgrade frei0r-plugins-opencvUpgrade frei0r-plugins-debugsourceUpgrade libsoup-develUpgrade pygobject3-debugsourceUpgrade pipewire-utilsUpgrade vte291-develUpgrade gtk3-debuginfoUpgrade gsettings-desktop-schemasUpgrade gtk3-immodule-ximUpgrade gtk3-develUpgrade PackageKit-command-not-found-debuginfoUpgrade vte291-debuginfoUpgrade LibRaw-debuginfoUpgrade xdg-desktop-portal-gtk-debugsourceUpgrade dleyna-renderer-debuginfoUpgrade frei0r-develUpgrade frei0r-plugins-opencv-debuginfoUpgrade pipewire0.2-debugsourceUpgrade gnome-remote-desktop-debuginfoUpgrade vte291-devel-debuginfoUpgrade LibRaw-debugsourceUpgrade pipewire-debugsourceUpgrade pipewire0.2-libs-debuginfoUpgrade pygobject3-develUpgrade gnome-sessionUpgrade vte291Upgrade pipewire-develUpgrade PackageKit-gstreamer-pluginUpgrade gsettings-desktop-schemas-develUpgrade vte291-debugsourceUpgrade potrace-debugsourceUpgrade pipewire-docUpgrade PackageKit-gtk3-module-debuginfoUpgrade pygobject3-debuginfoUpgrade vte-profileUpgrade PackageKit-debuginfoUpgrade gnome-remote-desktop-debugsourceUpgrade gnome-session-debugsourceUpgrade gtk3Upgrade gnome-session-debuginfoUpgrade pipewire0.2-libsUpgrade gnome-remote-desktopUpgrade frei0r-plugins-debuginfoUpgrade trackerUpgrade webrtc-audio-processing-debuginfoUpgrade potrace-debuginfoUpgrade pipewire0.2-develUpgrade pipewire-debuginfoUpgrade python3-gobjectUpgrade webrtc-audio-processing-debugsourceUpgrade PackageKit-glib-develUpgrade dleyna-rendererUpgrade gnome-session-xsessionUpgrade python3-gobject-base-debuginfoUpgrade webrtc-audio-processingUpgrade frei0r-pluginsUpgrade PackageKit-command-not-foundUpgrade gtk3-debugsourceUpgrade pipewire-libs-debuginfoUpgrade gtk-update-icon-cacheUpgrade libsoup-debugsourceUpgrade libsoup-debuginfoUpgrade gnome-session-wayland-sessionUpgrade pipewire-libsUpgrade pipewire-utils-debuginfoUpgrade PackageKitUpgrade gtk3-devel-debuginfoUpgrade python3-gobject-debuginfo | Mar 12, 2024 | Jul 2, 2020 |
| Suse | — | Upgrade libraw-develUpgrade libraw9Upgrade libraw-devel-staticUpgrade libraw-toolsUpgrade libraw16 | Jul 24, 2020 | Jul 2, 2020 |
| Ubuntu | — | Upgrade libraw16Upgrade libraw19 | Nov 8, 2022 | Jul 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub