Name: CVE-2018-20337: Out-of-bounds Write
Creator: Rapid7
Published: 2018-12-21T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2018-20337, CWE-787, CVSS 8.8, EPSS 0.00363

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

CVSS Details

CVSS 3.1 Base Score: 8.8
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade gnome-menus-develUpgrade gnome-tweaksUpgrade mozjs52-develUpgrade accountsservice-develUpgrade clutterUpgrade clutter-develUpgrade mozjs60-develUpgrade gjs-develUpgrade mozjs60Upgrade mozjs52Upgrade baobabUpgrade vala-develUpgrade clutter-docUpgrade gnome-menusUpgrade vala	May 4, 2022	Dec 21, 2018
Centos_linux	—	Upgrade gvfs-afpUpgrade gnome-settings-daemonUpgrade mozjs52-devel-debuginfoUpgrade gnome-session-debugsourceUpgrade gtk3-devel-debuginfoUpgrade gnome-settings-daemon-debugsourceUpgrade gnome-tweaksUpgrade gnome-online-accountsUpgrade gnome-control-center-debuginfoUpgrade gvfs-mtpUpgrade gnome-terminal-nautilus-debuginfoUpgrade evince-nautilusUpgrade libxslt-develUpgrade accountsservice-debuginfoUpgrade gnome-control-centerUpgrade libvncserver-debugsourceUpgrade clutter-debuginfoUpgrade gtk3Upgrade nautilusUpgrade evince-browser-pluginUpgrade gnome-software-editor-debuginfoUpgrade gnome-remote-desktopUpgrade gnome-session-wayland-sessionUpgrade evince-debugsourceUpgrade gvfs-gphoto2-debuginfoUpgrade gjsUpgrade gtk3-develUpgrade gnome-terminal-nautilusUpgrade gvfs-develUpgrade gvfs-afcUpgrade gvfs-client-debuginfoUpgrade gnome-software-debuginfoUpgrade vinagreUpgrade libvncserverUpgrade gvfs-fuseUpgrade nautilus-extensionsUpgrade gnome-terminal-debuginfoUpgrade gvfs-debuginfoUpgrade mozjs60Upgrade accountsservice-libsUpgrade LibRaw-debugsourceUpgrade gnome-session-debuginfoUpgrade mozjs60-debugsourceUpgrade clutter-debugsourceUpgrade gtk-update-icon-cacheUpgrade LibRaw-debuginfoUpgrade gnome-terminal-debugsourceUpgrade gvfs-smbUpgrade nautilus-extensions-debuginfoUpgrade gvfs-debugsourceUpgrade libxslt-debuginfoUpgrade gvfsUpgrade gnome-boxes-debuginfoUpgrade gdm-debuginfoUpgrade appstream-dataUpgrade gvfs-fuse-debuginfoUpgrade gnome-sessionUpgrade gtk3-tests-debuginfoUpgrade gnome-online-accounts-debuginfoUpgrade evince-libsUpgrade gdm-debugsourceUpgrade gnome-remote-desktop-debuginfoUpgrade mozjs60-debuginfoUpgrade libvncserver-debuginfoUpgrade gvfs-goaUpgrade gnome-software-debugsourceUpgrade gnome-shell-debugsourceUpgrade gtk3-debuginfoUpgrade gnome-terminalUpgrade gnome-remote-desktop-debugsourceUpgrade baobab-debugsourceUpgrade gnome-control-center-filesystemUpgrade gvfs-archiveUpgrade accountsservice-debugsourceUpgrade mozjs52-debuginfoUpgrade gsettings-desktop-schemasUpgrade gvfs-goa-debuginfoUpgrade baobab-debuginfoUpgrade gvfs-gphoto2Upgrade clutterUpgrade evince-browser-plugin-debuginfoUpgrade gvfs-afp-debuginfoUpgrade gnome-menus-debuginfoUpgrade gnome-boxes-debugsourceUpgrade gnome-shellUpgrade gnome-control-center-debugsourceUpgrade gvfs-mtp-debuginfoUpgrade gvfs-clientUpgrade gtk3-debugsourceUpgrade evince-nautilus-debuginfoUpgrade gnome-boxesUpgrade mozjs52-debugsourceUpgrade gnome-online-accounts-develUpgrade gnome-menus-debugsourceUpgrade gvfs-archive-debuginfoUpgrade gtk3-immodule-xim-debuginfoUpgrade mutter-debuginfoUpgrade evince-libs-debuginfoUpgrade gvfs-smb-debuginfoUpgrade gnome-softwareUpgrade LibRaw-samples-debuginfoUpgrade vinagre-debugsourceUpgrade accountsserviceUpgrade gnome-shell-debuginfoUpgrade gjs-tests-debuginfoUpgrade gdmUpgrade mutterUpgrade gnome-settings-daemon-debuginfoUpgrade nautilus-debuginfoUpgrade evinceUpgrade gjs-debugsourceUpgrade evince-debuginfoUpgrade gvfs-afc-debuginfoUpgrade libxslt-debugsourceUpgrade vinagre-debuginfoUpgrade gtk3-immodules-debuginfoUpgrade mutter-debugsourceUpgrade gtk3-immodule-ximUpgrade mutter-tests-debuginfoUpgrade baobabUpgrade accountsservice-libs-debuginfoUpgrade mozjs52Upgrade gnome-software-editorUpgrade libxsltUpgrade gtk-update-icon-cache-debuginfoUpgrade gnome-online-accounts-debugsourceUpgrade gsettings-desktop-schemas-develUpgrade nautilus-debugsourceUpgrade gjs-debuginfoUpgrade clutter-tests-debuginfoUpgrade LibRawUpgrade gnome-session-xsessionUpgrade gnome-menus	Apr 29, 2020	Dec 21, 2018
Debian	—	Upgrade libraw	Jul 30, 2024	Dec 21, 2018
Oracle_linux	—	Upgrade evince-libsUpgrade mozjs52-develUpgrade nautilus-extensionsUpgrade gnome-remote-desktopUpgrade libxslt-develUpgrade gnome-boxesUpgrade accountsservice-libsUpgrade valaUpgrade libvncserverUpgrade gtk-update-icon-cacheUpgrade evince-browser-pluginUpgrade gnome-terminal-nautilusUpgrade nautilusUpgrade gnome-settings-daemonUpgrade gnome-session-xsessionUpgrade LibRaw-develUpgrade gjsUpgrade gnome-sessionUpgrade gnome-menus-develUpgrade gnome-online-accountsUpgrade gnome-software-editorUpgrade mozjs60Upgrade evince-nautilusUpgrade gtk3-develUpgrade gnome-shellUpgrade clutter-develUpgrade gnome-control-centerUpgrade mozjs52Upgrade accountsserviceUpgrade gdmUpgrade LibRawUpgrade accountsservice-develUpgrade vinagreUpgrade gnome-online-accounts-develUpgrade libvncserver-develUpgrade libxsltUpgrade gnome-menusUpgrade gnome-softwareUpgrade clutter-docUpgrade mozjs60-develUpgrade gtk3Upgrade gsettings-desktop-schemas-develUpgrade gtk3-immodule-ximUpgrade vala-develUpgrade gnome-session-wayland-sessionUpgrade mutterUpgrade evinceUpgrade gnome-tweaksUpgrade clutterUpgrade nautilus-develUpgrade gjs-develUpgrade gnome-control-center-filesystemUpgrade gnome-terminalUpgrade gsettings-desktop-schemasUpgrade mutter-develUpgrade appstream-data	Jul 22, 2024	Dec 18, 2018
Redhat Openshift	—	Upgrade redhat-coreos	Dec 29, 2020	Dec 21, 2018
Redhat_linux	—	Upgrade gvfs-develUpgrade gvfs-mtp-debuginfoUpgrade gjs-develUpgrade gnome-control-center-debuginfoUpgrade gnome-terminal-nautilusUpgrade mozjs52-debuginfoUpgrade gvfs-afp-debuginfoUpgrade nautilus-develUpgrade gnome-software-editorUpgrade gnome-menusUpgrade valaUpgrade vala-debugsourceUpgrade gnome-boxes-debugsourceUpgrade gvfs-fuseUpgrade gvfs-archive-debuginfoUpgrade gnome-online-accounts-develUpgrade baobab-debugsourceUpgrade gvfs-smb-debuginfoUpgrade gvfs-gphoto2Upgrade LibRaw-samples-debuginfoUpgrade gnome-terminalUpgrade valadoc-debuginfoUpgrade gvfs-debugsourceUpgrade evince-libsUpgrade gvfs-afc-debuginfoUpgrade vinagre-debuginfoUpgrade gtk-update-icon-cache-debuginfoUpgrade gnome-tweaksUpgrade gsettings-desktop-schemasUpgrade gnome-shellUpgrade gnome-menus-develUpgrade evince-browser-plugin-debuginfoUpgrade appstream-dataUpgrade gnome-shell-debugsourceUpgrade gtk3-immodules-debuginfoUpgrade libvncserver-debuginfoUpgrade gnome-remote-desktopUpgrade gnome-settings-daemon-debuginfoUpgrade gnome-boxes-debuginfoUpgrade evince-browser-pluginUpgrade gtk3-debuginfoUpgrade baobab-debuginfoUpgrade mutter-debugsourceUpgrade evinceUpgrade mozjs52Upgrade gvfsUpgrade accountsservice-libs-debuginfoUpgrade gnome-online-accountsUpgrade gdmUpgrade gtk3-develUpgrade accountsservice-develUpgrade gnome-softwareUpgrade gvfs-mtpUpgrade accountsservice-debugsourceUpgrade libvncserver-develUpgrade evince-debugsourceUpgrade libxsltUpgrade nautilus-debuginfoUpgrade gtk3-tests-debuginfoUpgrade libxslt-debugsourceUpgrade nautilus-extensions-debuginfoUpgrade gvfs-archiveUpgrade mutter-develUpgrade gnome-boxesUpgrade gnome-software-debuginfoUpgrade gtk3-immodule-xim-debuginfoUpgrade vinagreUpgrade LibRaw-develUpgrade gjs-tests-debuginfoUpgrade libvncserverUpgrade gdm-debugsourceUpgrade mozjs60-debuginfoUpgrade gnome-session-debuginfoUpgrade nautilusUpgrade gnome-software-debugsourceUpgrade accountsserviceUpgrade gtk3-debugsourceUpgrade gsettings-desktop-schemas-develUpgrade LibRaw-debuginfoUpgrade gvfs-client-debuginfoUpgrade gvfs-goaUpgrade vinagre-debugsourceUpgrade libvncserver-debugsourceUpgrade accountsservice-libsUpgrade mozjs52-develUpgrade clutter-debugsourceUpgrade gvfs-smbUpgrade mutterUpgrade gdm-debuginfoUpgrade gnome-terminal-nautilus-debuginfoUpgrade gjsUpgrade clutter-docUpgrade gnome-menus-debugsourceUpgrade gvfs-debuginfoUpgrade gnome-session-wayland-sessionUpgrade clutter-develUpgrade gtk-update-icon-cacheUpgrade mozjs52-debugsourceUpgrade vala-debuginfoUpgrade mutter-tests-debuginfoUpgrade gtk3Upgrade mutter-debuginfoUpgrade libxslt-develUpgrade nautilus-extensionsUpgrade gnome-settings-daemonUpgrade nautilus-debugsourceUpgrade gnome-shell-debuginfoUpgrade gnome-remote-desktop-debuginfoUpgrade gjs-debugsourceUpgrade gnome-control-center-filesystemUpgrade gnome-terminal-debuginfoUpgrade gvfs-fuse-debuginfoUpgrade gvfs-goa-debuginfoUpgrade gnome-session-debugsourceUpgrade LibRawUpgrade LibRaw-debugsourceUpgrade evince-nautilus-debuginfoUpgrade gnome-settings-daemon-debugsourceUpgrade gvfs-afcUpgrade libxslt-debuginfoUpgrade evince-nautilusUpgrade clutter-debuginfoUpgrade accountsservice-debuginfoUpgrade gnome-terminal-debugsourceUpgrade gnome-control-centerUpgrade gvfs-afpUpgrade mozjs60-develUpgrade vala-develUpgrade gnome-software-editor-debuginfoUpgrade gnome-control-center-debugsourceUpgrade clutter-tests-debuginfoUpgrade clutterUpgrade mozjs60-debugsourceUpgrade evince-libs-debuginfoUpgrade gtk3-immodule-ximUpgrade gnome-online-accounts-debuginfoUpgrade mozjs52-devel-debuginfoUpgrade gnome-online-accounts-debugsourceUpgrade gjs-debuginfoUpgrade baobabUpgrade gnome-menus-debuginfoUpgrade gvfs-gphoto2-debuginfoUpgrade gvfs-clientUpgrade mozjs60Upgrade evince-debuginfoUpgrade gnome-session-xsessionUpgrade gnome-sessionUpgrade gnome-remote-desktop-debugsourceUpgrade gtk3-devel-debuginfo	Apr 29, 2020	Dec 21, 2018
Rocky_linux	—	Upgrade baobab-debugsourceUpgrade gnome-menus-debugsourceUpgrade clutter-debugsourceUpgrade clutter-docUpgrade mozjs52-debuginfoUpgrade mozjs60Upgrade baobabUpgrade mozjs60-debugsourceUpgrade clutter-debuginfoUpgrade baobab-debuginfoUpgrade gnome-menus-debuginfoUpgrade gnome-menusUpgrade mozjs60-debuginfoUpgrade mozjs52-develUpgrade clutterUpgrade mozjs52Upgrade gnome-menus-develUpgrade mozjs52-debugsourceUpgrade mozjs52-devel-debuginfoUpgrade clutter-develUpgrade mozjs60-devel	Mar 12, 2024	Dec 21, 2018
Suse	—	Upgrade libraw-toolsUpgrade libraw-develUpgrade libraw-devel-staticUpgrade libraw16	Jan 31, 2019	Dec 21, 2018
Ubuntu	—	Upgrade libraw15Upgrade libraw16	May 22, 2019	Dec 21, 2018

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence