LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mutter-develUpgrade pipewire0.2-libsUpgrade potraceUpgrade libsoup-develUpgrade pipewire-utilsUpgrade webrtc-audio-processingUpgrade vte-profileUpgrade pipewire0.2-develUpgrade PackageKit-gstreamer-pluginUpgrade python3-gobject-baseUpgrade python3-gobjectUpgrade pygobject3-develUpgrade pipewire-docUpgrade dleyna-rendererUpgrade PackageKit-command-not-foundUpgrade vte291Upgrade xdg-desktop-portal-gtkUpgrade tracker-develUpgrade PackageKit-cronUpgrade LibRaw-develUpgrade frei0r-develUpgrade PackageKit-glibUpgrade nautilusUpgrade gtk-docUpgrade frei0r-plugins-opencvUpgrade pipewire-libsUpgrade frei0r-pluginsUpgrade PackageKit-gtk3-moduleUpgrade libsoupUpgrade PackageKit-glib-develUpgrade PackageKitUpgrade nautilus-develUpgrade trackerUpgrade pipewire-develUpgrade pipewireUpgrade gvfsUpgrade vte291-develUpgrade gnome-remote-desktop | May 4, 2022 | Jul 2, 2020 |
| Alpine Linux | — | Upgrade libraw | Aug 7, 2020 | Jul 2, 2020 |
| Centos_linux | — | Upgrade mutter-debuginfoUpgrade PackageKitUpgrade gtk-update-icon-cacheUpgrade frei0r-pluginsUpgrade gtk-update-icon-cache-debuginfoUpgrade gtk3-immodule-xim-debuginfoUpgrade gnome-control-center-debugsourceUpgrade gvfs-mtpUpgrade gnome-remote-desktopUpgrade gnome-shell-extension-no-hot-cornerUpgrade gvfs-archive-debuginfoUpgrade gnome-shell-extension-window-grouperUpgrade pipewire-libs-debuginfoUpgrade gnome-shell-extension-desktop-iconsUpgrade potraceUpgrade nautilus-debuginfoUpgrade gnome-control-center-filesystemUpgrade gnome-shell-extension-windowsNavigatorUpgrade gnome-session-xsessionUpgrade gnome-settings-daemonUpgrade pipewire-develUpgrade mutter-debugsourceUpgrade webkit2gtk3-jsc-devel-debuginfoUpgrade gtk3-tests-debuginfoUpgrade gnome-shell-extension-launch-new-instanceUpgrade xdg-desktop-portal-debugsourceUpgrade webrtc-audio-processingUpgrade gnome-shell-extension-panel-favoritesUpgrade gnome-terminal-debuginfoUpgrade pipewire-debuginfoUpgrade pipewire0.2-libs-debuginfoUpgrade gvfs-afpUpgrade gnome-classic-sessionUpgrade frei0r-plugins-opencvUpgrade gtk3-debuginfoUpgrade PackageKit-cronUpgrade gdm-debuginfoUpgrade nautilusUpgrade python3-gobject-base-debuginfoUpgrade pipewire-docUpgrade potrace-debugsourceUpgrade gdmUpgrade gtk3-devel-debuginfoUpgrade tracker-debuginfoUpgrade potrace-debuginfoUpgrade gvfs-fuse-debuginfoUpgrade gnome-terminal-debugsourceUpgrade vte291-devel-debuginfoUpgrade webkit2gtk3-jsc-develUpgrade gnome-terminal-nautilusUpgrade pipewire-alsa-debuginfoUpgrade webkit2gtk3-devel-debuginfoUpgrade gtk3-debugsourceUpgrade python3-gobject-debuginfoUpgrade gdm-debugsourceUpgrade vte291Upgrade webkit2gtk3-debugsourceUpgrade pipewire0.2-libsUpgrade webkit2gtk3-jscUpgrade gtk3-immodules-debuginfoUpgrade gvfs-afc-debuginfoUpgrade gtk3-develUpgrade gvfs-debuginfoUpgrade gnome-session-debuginfoUpgrade gnome-shellUpgrade gtk3Upgrade gnome-shell-extension-user-themeUpgrade libsoup-debuginfoUpgrade libsoup-debugsourceUpgrade gvfs-develUpgrade webrtc-audio-processing-debuginfoUpgrade gvfs-clientUpgrade trackerUpgrade frei0r-plugins-debuginfoUpgrade gvfs-debugsourceUpgrade gnome-shell-extension-screenshot-window-sizerUpgrade LibRaw-samples-debuginfoUpgrade gnome-shell-extension-native-window-placementUpgrade PackageKit-debuginfoUpgrade gnome-terminalUpgrade webkit2gtk3-jsc-debuginfoUpgrade gnome-remote-desktop-debugsourceUpgrade pipewire-libsUpgrade gnome-photos-testsUpgrade vte-profileUpgrade gnome-shell-extension-places-menuUpgrade gnome-shell-extension-horizontal-workspacesUpgrade nautilus-debugsourceUpgrade nautilus-extensions-debuginfoUpgrade webkit2gtk3-debuginfoUpgrade PackageKit-command-not-foundUpgrade gvfs-smb-debuginfoUpgrade PackageKit-gtk3-module-debuginfoUpgrade gvfs-smbUpgrade frei0r-plugins-opencv-debuginfoUpgrade mutter-tests-debuginfoUpgrade xdg-desktop-portal-gtk-debuginfoUpgrade webkit2gtk3Upgrade gnome-photosUpgrade gnome-shell-debugsourceUpgrade pipewire0.2-develUpgrade libsoup-develUpgrade gnome-shell-extension-window-listUpgrade gnome-shell-debuginfoUpgrade gvfs-client-debuginfoUpgrade gvfs-afp-debuginfoUpgrade gtk3-immodule-ximUpgrade gnome-terminal-nautilus-debuginfoUpgrade gnome-shell-extension-apps-menuUpgrade gnome-remote-desktop-debuginfoUpgrade xdg-desktop-portal-gtkUpgrade webkit2gtk3-develUpgrade vte291-debugsourceUpgrade python3-gobject-baseUpgrade pipewire0.2-debugsourceUpgrade pipewire-utils-debuginfoUpgrade pipewire-gstreamer-debuginfoUpgrade PackageKit-glib-debuginfoUpgrade LibRaw-debuginfoUpgrade gnome-shell-extension-updates-dialogUpgrade LibRawUpgrade gvfs-fuseUpgrade gvfs-afcUpgrade nautilus-extensionsUpgrade frei0r-plugins-debugsourceUpgrade gnome-shell-extension-auto-move-windowsUpgrade gsettings-desktop-schemasUpgrade gnome-settings-daemon-debugsourceUpgrade dleyna-renderer-debugsourceUpgrade pygobject3-debugsourceUpgrade pipewire-debugsourceUpgrade PackageKit-glibUpgrade xdg-desktop-portal-debuginfoUpgrade vte291-debuginfoUpgrade PackageKit-gstreamer-plugin-debuginfoUpgrade PackageKit-command-not-found-debuginfoUpgrade gvfs-mtp-debuginfoUpgrade gnome-session-debugsourceUpgrade gvfs-goaUpgrade PackageKit-debugsourceUpgrade gnome-shell-extension-workspace-indicatorUpgrade LibRaw-debugsourceUpgrade PackageKit-gtk3-moduleUpgrade gnome-sessionUpgrade gnome-photos-debuginfoUpgrade gsettings-desktop-schemas-develUpgrade xdg-desktop-portalUpgrade PackageKit-gstreamer-pluginUpgrade pygobject3-debuginfoUpgrade webrtc-audio-processing-debugsourceUpgrade gnome-session-wayland-sessionUpgrade gnome-shell-extension-drive-menuUpgrade pipewire-utilsUpgrade mutterUpgrade libsoupUpgrade gvfsUpgrade gnome-shell-extension-systemMonitorUpgrade gnome-shell-extension-disable-screenshieldUpgrade dleyna-rendererUpgrade gnome-shell-extension-dash-to-dockUpgrade gnome-settings-daemon-debuginfoUpgrade gvfs-gphoto2-debuginfoUpgrade gnome-control-center-debuginfoUpgrade gnome-control-centerUpgrade gvfs-archiveUpgrade tracker-debugsourceUpgrade python3-gobjectUpgrade gvfs-goa-debuginfoUpgrade gnome-shell-extension-top-iconsUpgrade gnome-shell-extension-commonUpgrade gnome-photos-debugsourceUpgrade dleyna-renderer-debuginfoUpgrade pipewireUpgrade xdg-desktop-portal-gtk-debugsourceUpgrade gvfs-gphoto2 | Nov 5, 2020 | Jul 2, 2020 |
| Debian | — | Upgrade libraw | Dec 2, 2022 | Jul 2, 2020 |
| Oracle_linux | — | Upgrade frei0r-plugins-opencvUpgrade gnome-sessionUpgrade gnome-shell-extension-disable-screenshieldUpgrade gnome-shell-extension-panel-favoritesUpgrade gnome-shell-extension-drive-menuUpgrade gnome-shell-extension-places-menuUpgrade nautilusUpgrade gnome-shell-extension-desktop-iconsUpgrade frei0r-pluginsUpgrade gnome-terminal-nautilusUpgrade gvfs-afcUpgrade pipewire0.2-develUpgrade nautilus-extensionsUpgrade PackageKitUpgrade gnome-shell-extension-windowsNavigatorUpgrade gnome-photosUpgrade trackerUpgrade gnome-remote-desktopUpgrade gnome-shell-extension-screenshot-window-sizerUpgrade pipewireUpgrade webkit2gtk3-jsc-develUpgrade xdg-desktop-portalUpgrade xdg-desktop-portal-gtkUpgrade vte291-develUpgrade frei0r-develUpgrade gtk-update-icon-cacheUpgrade gvfs-clientUpgrade gvfs-goaUpgrade LibRaw-develUpgrade gtk3-develUpgrade webkit2gtk3-jscUpgrade gnome-classic-sessionUpgrade gnome-shell-extension-window-listUpgrade gnome-shell-extension-horizontal-workspacesUpgrade gvfs-afpUpgrade gnome-control-center-filesystemUpgrade gnome-settings-daemonUpgrade PackageKit-glib-develUpgrade gnome-shell-extension-no-hot-cornerUpgrade gnome-shellUpgrade gnome-shell-extension-commonUpgrade gnome-shell-extension-launch-new-instanceUpgrade gsettings-desktop-schemasUpgrade gvfs-mtpUpgrade pipewire0.2-libsUpgrade pipewire-libsUpgrade gvfs-develUpgrade vte291Upgrade pipewire-develUpgrade gnome-session-xsessionUpgrade gnome-shell-extension-window-grouperUpgrade gtk3Upgrade pipewire-docUpgrade nautilus-develUpgrade LibRawUpgrade PackageKit-command-not-foundUpgrade PackageKit-gstreamer-pluginUpgrade potraceUpgrade gnome-shell-extension-apps-menuUpgrade pygobject3-develUpgrade gnome-shell-extension-updates-dialogUpgrade gnome-shell-extension-auto-move-windowsUpgrade gvfs-fuseUpgrade gnome-photos-testsUpgrade gnome-control-centerUpgrade PackageKit-glibUpgrade mutterUpgrade tracker-develUpgrade gnome-shell-extension-workspace-indicatorUpgrade vte-profileUpgrade mutter-develUpgrade libsoupUpgrade PackageKit-cronUpgrade webrtc-audio-processingUpgrade webkit2gtk3Upgrade libsoup-develUpgrade gnome-terminalUpgrade gdmUpgrade gnome-shell-extension-systemMonitorUpgrade python3-gobjectUpgrade gvfs-archiveUpgrade gsettings-desktop-schemas-develUpgrade gtk-docUpgrade gtk3-immodule-ximUpgrade gvfs-smbUpgrade gnome-shell-extension-native-window-placementUpgrade gnome-session-wayland-sessionUpgrade pipewire-utilsUpgrade PackageKit-gtk3-moduleUpgrade webkit2gtk3-develUpgrade gvfsUpgrade gnome-shell-extension-top-iconsUpgrade python3-gobject-baseUpgrade gvfs-gphoto2Upgrade gnome-shell-extension-user-themeUpgrade gnome-shell-extension-dash-to-dockUpgrade dleyna-renderer | Nov 12, 2020 | Jun 22, 2020 |
| Redhat_linux | — | Upgrade PackageKit-gstreamer-pluginUpgrade gtk3-immodule-ximUpgrade gvfs-client-debuginfoUpgrade mutter-debuginfoUpgrade pipewire-docUpgrade pipewire0.2-debugsourceUpgrade tracker-develUpgrade gvfs-gphoto2-debuginfoUpgrade gnome-photos-testsUpgrade gnome-shell-extension-auto-move-windowsUpgrade mutterUpgrade gvfs-clientUpgrade webkit2gtk3-jsc-develUpgrade pygobject3-debugsourceUpgrade dleyna-renderer-debugsourceUpgrade gtk3Upgrade pipewire-debugsourceUpgrade PackageKit-gstreamer-plugin-debuginfoUpgrade gnome-terminal-nautilus-debuginfoUpgrade gnome-session-debugsourceUpgrade PackageKit-debugsourceUpgrade gnome-shell-extension-drive-menuUpgrade libsoup-develUpgrade frei0r-develUpgrade gnome-shell-debuginfoUpgrade gnome-shell-extension-workspace-indicatorUpgrade gvfs-smbUpgrade gsettings-desktop-schemas-develUpgrade mutter-tests-debuginfoUpgrade pipewire-gstreamer-debuginfoUpgrade gvfs-goa-debuginfoUpgrade LibRawNo solution existsUpgrade dleyna-rendererUpgrade gtk3-devel-debuginfoUpgrade potrace-debugsourceUpgrade pipewire0.2-libsUpgrade gnome-shell-extension-systemMonitorUpgrade gvfs-afp-debuginfoUpgrade gnome-terminal-debuginfoUpgrade gnome-remote-desktop-debuginfoUpgrade nautilus-extensionsUpgrade webkit2gtk3-jsc-devel-debuginfoUpgrade xdg-desktop-portal-debuginfoUpgrade pipewire-utilsUpgrade gvfs-goaUpgrade PackageKit-command-not-found-debuginfoUpgrade gnome-shell-extension-updates-dialogUpgrade potrace-debuginfoUpgrade gnome-photos-debuginfoUpgrade gnome-session-wayland-sessionUpgrade gvfs-debuginfoUpgrade nautilus-develUpgrade gnome-remote-desktop-debugsourceUpgrade tracker-debugsourceUpgrade gvfsUpgrade gnome-settings-daemon-debuginfoUpgrade gdm-debuginfoUpgrade PackageKit-glibUpgrade pipewire-libs-debuginfoUpgrade webkit2gtk3Upgrade xdg-desktop-portal-gtkUpgrade LibRaw-debuginfoUpgrade python3-gobjectUpgrade pipewire0.2-develUpgrade webkit2gtk3-debuginfoUpgrade webrtc-audio-processingUpgrade webrtc-audio-processing-debugsourceUpgrade nautilus-extensions-debuginfoUpgrade nautilus-debugsourceUpgrade pygobject3-debuginfoUpgrade libsoupUpgrade PackageKit-debuginfoUpgrade gnome-control-centerUpgrade vte291-debugsourceUpgrade webkit2gtk3-develUpgrade gnome-session-xsessionUpgrade python3-gobject-baseUpgrade frei0r-plugins-opencv-debuginfoUpgrade gvfs-debugsourceUpgrade xdg-desktop-portal-gtk-debugsourceUpgrade frei0r-plugins-debugsourceUpgrade gvfs-afcUpgrade gnome-settings-daemon-debugsourceUpgrade vte291Upgrade gnome-shell-extension-window-grouperUpgrade gnome-shell-extension-no-hot-cornerUpgrade gvfs-fuse-debuginfoUpgrade LibRaw-debugsourceUpgrade gnome-control-center-debugsourceUpgrade tracker-debuginfoUpgrade gnome-shell-extension-launch-new-instanceUpgrade gnome-sessionUpgrade gnome-photosUpgrade PackageKit-gtk3-module-debuginfoUpgrade vte291-develUpgrade gnome-shell-extension-windowsNavigatorUpgrade gnome-control-center-filesystemUpgrade gdm-debugsourceUpgrade webkit2gtk3-debugsourceUpgrade gtk-update-icon-cache-debuginfoUpgrade gtk-docUpgrade gnome-terminal-nautilusUpgrade gvfs-archiveUpgrade xdg-desktop-portalUpgrade gnome-photos-debugsourceUpgrade pipewire-libsUpgrade PackageKit-glib-debuginfoUpgrade gnome-shell-extension-screenshot-window-sizerUpgrade libsoup-debugsourceUpgrade gdmUpgrade potraceUpgrade mutter-debugsourceUpgrade dleyna-renderer-debuginfoUpgrade gnome-shell-extension-window-listUpgrade vte291-devel-debuginfoUpgrade gnome-shellUpgrade gnome-classic-sessionUpgrade gnome-shell-extension-top-iconsUpgrade gvfs-fuseUpgrade gtk-update-icon-cacheUpgrade PackageKitUpgrade pygobject3-develUpgrade gtk3-debugsourceUpgrade gnome-session-debuginfoUpgrade gnome-shell-extension-dash-to-dockUpgrade pipewire-debuginfoUpgrade pipewire0.2-libs-debuginfoUpgrade PackageKit-cronUpgrade nautilusUpgrade gnome-shell-extension-panel-favoritesUpgrade gtk3-tests-debuginfoUpgrade frei0r-plugins-debuginfoUpgrade gvfs-mtpUpgrade gnome-shell-extension-desktop-iconsUpgrade nautilus-debuginfoUpgrade frei0r-plugins-opencvUpgrade gvfs-smb-debuginfoUpgrade PackageKit-gtk3-moduleUpgrade PackageKit-glib-develUpgrade webrtc-audio-processing-debuginfoUpgrade webkit2gtk3-jscUpgrade frei0r-pluginsUpgrade webkit2gtk3-devel-debuginfoUpgrade python3-gobject-debuginfoUpgrade libsoup-debuginfoUpgrade gvfs-develUpgrade gnome-shell-extension-apps-menuUpgrade gnome-shell-extension-commonUpgrade webkit2gtk3-jsc-debuginfoUpgrade gtk3-immodules-debuginfoUpgrade xdg-desktop-portal-gtk-debuginfoUpgrade gnome-shell-extension-disable-screenshieldUpgrade LibRaw-samples-debuginfoUpgrade pipewire-alsa-debuginfoUpgrade gvfs-mtp-debuginfoUpgrade gnome-terminal-debugsourceUpgrade pipewire-utils-debuginfoUpgrade gnome-shell-extension-places-menuUpgrade xdg-desktop-portal-debugsourceUpgrade pipewireUpgrade gvfs-archive-debuginfoUpgrade gtk3-debuginfoUpgrade gnome-shell-extension-user-themeUpgrade vte291-debuginfoUpgrade gtk3-immodule-xim-debuginfoUpgrade gnome-shell-extension-horizontal-workspacesUpgrade mutter-develUpgrade pipewire-develUpgrade gnome-shell-debugsourceUpgrade vte-profileUpgrade PackageKit-command-not-foundUpgrade python3-gobject-base-debuginfoUpgrade gnome-control-center-debuginfoUpgrade gsettings-desktop-schemasUpgrade trackerUpgrade gvfs-gphoto2Upgrade gvfs-afpUpgrade gnome-shell-extension-native-window-placementUpgrade LibRaw-develUpgrade gnome-settings-daemonUpgrade gvfs-afc-debuginfoUpgrade gnome-terminalUpgrade gnome-remote-desktopUpgrade gtk3-devel | Nov 5, 2020 | Jul 2, 2020 |
| Rocky_linux | — | Upgrade pipewire0.2-develUpgrade potrace-debuginfoUpgrade python3-gobjectUpgrade pipewire-debuginfoUpgrade pipewire-debugsourceUpgrade pipewire-develUpgrade gnome-sessionUpgrade gsettings-desktop-schemas-develUpgrade vte291-devel-debuginfoUpgrade python3-gobject-base-debuginfoUpgrade dleyna-rendererUpgrade vte291-debugsourceUpgrade gnome-session-wayland-sessionUpgrade frei0r-pluginsUpgrade PackageKit-gstreamer-pluginUpgrade vte291Upgrade gtk-update-icon-cacheUpgrade gtk3-debugsourceUpgrade libsoup-debugsourceUpgrade libsoup-debuginfoUpgrade PackageKit-command-not-foundUpgrade PackageKitUpgrade pipewire-libs-debuginfoUpgrade pipewire-utils-debuginfoUpgrade gtk3-devel-debuginfoUpgrade pipewire-libsUpgrade pipewire0.2-libs-debuginfoUpgrade gnome-session-xsessionUpgrade python3-gobject-debuginfoUpgrade pygobject3-develUpgrade potrace-debugsourceUpgrade webrtc-audio-processingUpgrade gnome-session-debuginfoUpgrade pipewire0.2-libsUpgrade gnome-remote-desktopUpgrade webrtc-audio-processing-debuginfoUpgrade gtk3Upgrade pipewire-docUpgrade frei0r-plugins-debuginfoUpgrade gnome-remote-desktop-debugsourceUpgrade PackageKit-gtk3-module-debuginfoUpgrade PackageKit-debuginfoUpgrade pygobject3-debuginfoUpgrade webrtc-audio-processing-debugsourceUpgrade PackageKit-glib-develUpgrade trackerUpgrade gnome-session-debugsourceUpgrade vte-profileUpgrade LibRaw-debugsourceUpgrade tracker-debuginfoUpgrade xdg-desktop-portal-gtk-debuginfoUpgrade libsoupUpgrade dleyna-renderer-debugsourceUpgrade PackageKit-glib-debuginfoUpgrade python3-gobject-baseUpgrade gtk3-immodule-xim-debuginfoUpgrade vte291-debuginfoUpgrade PackageKit-command-not-found-debuginfoUpgrade gsettings-desktop-schemasUpgrade gtk3-develUpgrade gnome-remote-desktop-debuginfoUpgrade dleyna-renderer-debuginfoUpgrade vte291-develUpgrade LibRawUpgrade PackageKit-glibUpgrade xdg-desktop-portal-gtk-debugsourceUpgrade frei0r-develUpgrade tracker-develUpgrade LibRaw-debuginfoUpgrade PackageKit-cronUpgrade frei0r-plugins-opencvUpgrade PackageKit-gstreamer-plugin-debuginfoUpgrade tracker-debugsourceUpgrade pipewireUpgrade PackageKit-debugsourceUpgrade xdg-desktop-portal-gtkUpgrade pipewire0.2-debugsourceUpgrade frei0r-plugins-opencv-debuginfoUpgrade potraceUpgrade gtk3-debuginfoUpgrade frei0r-plugins-debugsourceUpgrade pygobject3-debugsourceUpgrade pipewire-utilsUpgrade libsoup-develUpgrade gtk3-immodule-ximUpgrade gtk-update-icon-cache-debuginfoUpgrade PackageKit-gtk3-moduleUpgrade LibRaw-devel | Mar 12, 2024 | Jul 2, 2020 |
| Suse | — | Upgrade libraw9Upgrade libraw-devel-staticUpgrade libraw-develUpgrade libraw-toolsUpgrade libraw16 | Jul 24, 2020 | Jul 2, 2020 |
| Ubuntu | — | Upgrade libraw19Upgrade libraw16 | Nov 8, 2022 | Jul 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub