There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade clutter-docUpgrade vala-develUpgrade gnome-menusUpgrade baobabUpgrade valaUpgrade gjs-develUpgrade gnome-menus-develUpgrade mozjs52-develUpgrade clutter-develUpgrade mozjs60-develUpgrade gnome-tweaksUpgrade mozjs52Upgrade clutterUpgrade mozjs60Upgrade accountsservice-devel | May 4, 2022 | Dec 21, 2018 |
| Centos_linux | — | Upgrade gnome-software-editorUpgrade LibRaw-samples-debuginfoUpgrade mozjs52-debuginfoUpgrade gvfs-goa-debuginfoUpgrade gvfs-afp-debuginfoUpgrade gnome-terminalUpgrade evince-nautilus-debuginfoUpgrade gtk3-debugsourceUpgrade evinceUpgrade gnome-online-accounts-debugsourceUpgrade baobab-debugsourceUpgrade gvfs-afc-debuginfoUpgrade LibRawUpgrade libxslt-debugsourceUpgrade vinagre-debugsourceUpgrade gtk3-debuginfoUpgrade gsettings-desktop-schemasUpgrade gnome-menusUpgrade nautilus-debuginfoUpgrade evince-browser-plugin-debuginfoUpgrade gnome-shell-debugsourceUpgrade gnome-software-debugsourceUpgrade gnome-control-center-filesystemUpgrade gnome-settings-daemon-debuginfoUpgrade gnome-remote-desktop-debugsourceUpgrade gvfs-gphoto2Upgrade gnome-boxesUpgrade gnome-softwareUpgrade mutter-debugsourceUpgrade clutter-tests-debuginfoUpgrade gjs-tests-debuginfoUpgrade gnome-session-xsessionUpgrade nautilus-debugsourceUpgrade gjs-debuginfoUpgrade mutter-debuginfoUpgrade gnome-menus-debuginfoUpgrade gvfs-smb-debuginfoUpgrade mutterUpgrade gvfs-clientUpgrade gnome-online-accounts-develUpgrade gvfs-archive-debuginfoUpgrade gtk3-immodule-xim-debuginfoUpgrade mutter-tests-debuginfoUpgrade gnome-menus-debugsourceUpgrade gnome-shellUpgrade evince-libs-debuginfoUpgrade mozjs52Upgrade accountsservice-libs-debuginfoUpgrade libxsltUpgrade evince-debuginfoUpgrade gtk3-immodule-ximUpgrade gtk-update-icon-cache-debuginfoUpgrade vinagre-debuginfoUpgrade gnome-control-center-debugsourceUpgrade gdmUpgrade gtk3-immodules-debuginfoUpgrade clutterUpgrade gvfs-mtp-debuginfoUpgrade gvfs-archiveUpgrade baobab-debuginfoUpgrade gnome-boxes-debugsourceUpgrade baobabUpgrade mozjs52-debugsourceUpgrade gnome-shell-debuginfoUpgrade accountsservice-debugsourceUpgrade gjs-debugsourceUpgrade accountsserviceUpgrade gsettings-desktop-schemas-develUpgrade mozjs60Upgrade clutter-debugsourceUpgrade vinagreUpgrade gnome-session-debugsourceUpgrade mozjs52-devel-debuginfoUpgrade LibRaw-debugsourceUpgrade nautilusUpgrade gvfs-develUpgrade clutter-debuginfoUpgrade gtk3Upgrade gdm-debuginfoUpgrade evince-browser-pluginUpgrade gjsUpgrade gtk-update-icon-cacheUpgrade nautilus-extensions-debuginfoUpgrade gnome-software-debuginfoUpgrade evince-nautilusUpgrade gvfs-debuginfoUpgrade gnome-terminal-debuginfoUpgrade evince-libsUpgrade gnome-online-accounts-debuginfoUpgrade gnome-boxes-debuginfoUpgrade libxslt-debuginfoUpgrade appstream-dataUpgrade evince-debugsourceUpgrade gnome-online-accountsUpgrade libxslt-develUpgrade gvfs-debugsourceUpgrade libvncserver-debuginfoUpgrade libvncserver-debugsourceUpgrade accountsservice-libsUpgrade gnome-settings-daemonUpgrade accountsservice-debuginfoUpgrade gvfs-fuseUpgrade gnome-session-wayland-sessionUpgrade gnome-terminal-debugsourceUpgrade gvfs-smbUpgrade LibRaw-debuginfoUpgrade gtk3-develUpgrade gnome-control-centerUpgrade gnome-sessionUpgrade gvfs-goaUpgrade gnome-remote-desktopUpgrade gvfs-gphoto2-debuginfoUpgrade gnome-control-center-debuginfoUpgrade gvfsUpgrade gnome-terminal-nautilus-debuginfoUpgrade gnome-settings-daemon-debugsourceUpgrade gtk3-devel-debuginfoUpgrade gnome-tweaksUpgrade gnome-software-editor-debuginfoUpgrade gvfs-client-debuginfoUpgrade gvfs-afpUpgrade libvncserverUpgrade gvfs-afcUpgrade gtk3-tests-debuginfoUpgrade gdm-debugsourceUpgrade gnome-terminal-nautilusUpgrade nautilus-extensionsUpgrade gnome-remote-desktop-debuginfoUpgrade mozjs60-debuginfoUpgrade gvfs-fuse-debuginfoUpgrade mozjs60-debugsourceUpgrade gnome-session-debuginfoUpgrade gvfs-mtp | Apr 29, 2020 | Dec 21, 2018 |
| Debian | — | Upgrade libraw | Jul 30, 2024 | Dec 21, 2018 |
| Oracle_linux | — | Upgrade libxsltUpgrade libvncserver-develUpgrade gtk3Upgrade gsettings-desktop-schemas-develUpgrade gnome-session-wayland-sessionUpgrade clutter-docUpgrade mutterUpgrade nautilus-develUpgrade gjs-develUpgrade appstream-dataUpgrade gdmUpgrade clutterUpgrade gtk3-immodule-ximUpgrade evinceUpgrade gnome-tweaksUpgrade gnome-menusUpgrade gnome-online-accounts-develUpgrade accountsserviceUpgrade vala-develUpgrade gsettings-desktop-schemasUpgrade gnome-softwareUpgrade accountsservice-develUpgrade gnome-control-center-filesystemUpgrade LibRawUpgrade mozjs60-develUpgrade mozjs52Upgrade gnome-terminalUpgrade vinagreUpgrade mutter-develUpgrade gnome-session-xsessionUpgrade gnome-remote-desktopUpgrade gnome-terminal-nautilusUpgrade evince-browser-pluginUpgrade accountsservice-libsUpgrade gnome-menus-develUpgrade gnome-online-accountsUpgrade gnome-settings-daemonUpgrade clutter-develUpgrade gtk-update-icon-cacheUpgrade mozjs52-develUpgrade valaUpgrade mozjs60Upgrade gnome-control-centerUpgrade libvncserverUpgrade nautilus-extensionsUpgrade libxslt-develUpgrade nautilusUpgrade evince-nautilusUpgrade gnome-shellUpgrade gnome-sessionUpgrade evince-libsUpgrade gjsUpgrade gtk3-develUpgrade LibRaw-develUpgrade gnome-boxesUpgrade gnome-software-editor | Jul 22, 2024 | Dec 18, 2018 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Dec 21, 2018 |
| Redhat_linux | — | Upgrade gtk3Upgrade mozjs60Upgrade gnome-sessionUpgrade gvfs-gphoto2-debuginfoUpgrade mozjs52-debugsourceUpgrade gvfs-fuse-debuginfoUpgrade mozjs52-develUpgrade vala-debuginfoUpgrade libvncserver-debugsourceUpgrade gvfs-goaUpgrade vinagre-debugsourceUpgrade gnome-remote-desktop-debugsourceUpgrade clutter-debuginfoUpgrade gnome-session-debugsourceUpgrade gnome-terminal-debuginfoUpgrade accountsservice-debuginfoUpgrade gtk3-devel-debuginfoUpgrade accountsservice-libsUpgrade mozjs52-devel-debuginfoUpgrade mutterUpgrade nautilus-debugsourceUpgrade gnome-online-accounts-debugsourceUpgrade gjs-debugsourceUpgrade gjs-debuginfoUpgrade LibRaw-debugsourceUpgrade evince-nautilusUpgrade gvfs-client-debuginfoUpgrade gvfs-goa-debuginfoUpgrade LibRaw-debuginfoUpgrade nautilus-extensionsUpgrade accountsserviceUpgrade libxslt-develUpgrade gnome-software-debugsourceUpgrade gnome-terminal-nautilus-debuginfoUpgrade gtk3-debugsourceUpgrade gdm-debuginfoUpgrade gnome-menus-debuginfoUpgrade evince-libs-debuginfoUpgrade evince-debuginfoUpgrade gnome-settings-daemon-debugsourceUpgrade gvfs-clientUpgrade clutter-docUpgrade mozjs60-debugsourceUpgrade clutterUpgrade LibRawUpgrade baobabUpgrade gnome-session-wayland-sessionUpgrade gvfs-afcUpgrade clutter-develUpgrade gvfs-smbUpgrade gjsUpgrade gnome-session-xsessionUpgrade evince-nautilus-debuginfoUpgrade gsettings-desktop-schemas-develUpgrade mutter-debuginfoUpgrade mutter-tests-debuginfoUpgrade gnome-control-centerUpgrade gtk-update-icon-cacheUpgrade gvfs-afpUpgrade gnome-software-editor-debuginfoUpgrade gnome-shell-debuginfoUpgrade libxslt-debuginfoUpgrade gnome-remote-desktop-debuginfoUpgrade gnome-control-center-debugsourceUpgrade gvfs-debuginfoUpgrade gtk3-immodule-ximUpgrade gnome-online-accounts-debuginfoUpgrade mozjs60-develUpgrade vala-develUpgrade gnome-settings-daemonUpgrade clutter-tests-debuginfoUpgrade clutter-debugsourceUpgrade gnome-menus-debugsourceUpgrade gnome-terminal-debugsourceUpgrade gnome-control-center-filesystemUpgrade valaUpgrade gnome-tweaksUpgrade gdm-debugsourceUpgrade mozjs60-debuginfoUpgrade gvfs-fuseUpgrade baobab-debugsourceUpgrade gvfsUpgrade mozjs52Upgrade gtk-update-icon-cache-debuginfoUpgrade gnome-control-center-debuginfoUpgrade evinceUpgrade gnome-boxes-debugsourceUpgrade gtk3-immodule-xim-debuginfoUpgrade accountsservice-libs-debuginfoUpgrade gnome-remote-desktopUpgrade valadoc-debuginfoUpgrade gvfs-mtp-debuginfoUpgrade accountsservice-debugsourceUpgrade evince-browser-pluginUpgrade appstream-dataUpgrade evince-libsUpgrade gnome-software-debuginfoUpgrade gnome-settings-daemon-debuginfoUpgrade nautilus-debuginfoUpgrade libvncserver-debuginfoUpgrade gtk3-tests-debuginfoUpgrade gnome-boxesUpgrade gvfs-gphoto2Upgrade vinagreUpgrade vala-debugsourceUpgrade libvncserverUpgrade gnome-online-accounts-develUpgrade gnome-terminal-nautilusUpgrade gjs-tests-debuginfoUpgrade nautilusUpgrade gvfs-archive-debuginfoUpgrade LibRaw-samples-debuginfoUpgrade gnome-boxes-debuginfoUpgrade evince-browser-plugin-debuginfoUpgrade gvfs-debugsourceUpgrade gnome-shellUpgrade baobab-debuginfoUpgrade gnome-terminalUpgrade libvncserver-develUpgrade gvfs-afc-debuginfoUpgrade mozjs52-debuginfoUpgrade gjs-develUpgrade gnome-menusUpgrade gvfs-archiveUpgrade gtk3-immodules-debuginfoUpgrade gnome-softwareUpgrade libxsltUpgrade gnome-session-debuginfoUpgrade gnome-menus-develUpgrade gvfs-develUpgrade gdmUpgrade libxslt-debugsourceUpgrade LibRaw-develUpgrade accountsservice-develUpgrade gtk3-develUpgrade gvfs-mtpUpgrade gtk3-debuginfoUpgrade gsettings-desktop-schemasUpgrade mutter-debugsourceUpgrade gnome-online-accountsUpgrade nautilus-extensions-debuginfoUpgrade nautilus-develUpgrade mutter-develUpgrade evince-debugsourceUpgrade gnome-shell-debugsourceUpgrade vinagre-debuginfoUpgrade gvfs-smb-debuginfoUpgrade gnome-software-editorUpgrade gvfs-afp-debuginfo | Apr 29, 2020 | Dec 21, 2018 |
| Rocky_linux | — | Upgrade mozjs52Upgrade mozjs60-debuginfoUpgrade gnome-menus-develUpgrade mozjs52-debugsourceUpgrade clutterUpgrade mozjs52-devel-debuginfoUpgrade mozjs52-develUpgrade mozjs60-develUpgrade clutter-develUpgrade mozjs60Upgrade mozjs52-debuginfoUpgrade clutter-docUpgrade baobab-debugsourceUpgrade clutter-debuginfoUpgrade baobab-debuginfoUpgrade gnome-menus-debugsourceUpgrade baobabUpgrade mozjs60-debugsourceUpgrade gnome-menus-debuginfoUpgrade gnome-menusUpgrade clutter-debugsource | Mar 12, 2024 | Dec 21, 2018 |
| Suse | — | Upgrade libraw-toolsUpgrade libraw-devel-staticUpgrade libraw-develUpgrade libraw16 | Jan 31, 2019 | Dec 21, 2018 |
| Ubuntu | — | Upgrade libraw16Upgrade libraw15 | May 22, 2019 | Dec 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub