Libraw
by Libraw
Source repositories
CVEs (64)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-32142 | 0.00 | — | 0.00 | Feb 17, 2023 | Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp. | |||
| CVE-2020-35533 | 0.00 | — | 0.00 | Sep 1, 2022 | In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file. | |||
| CVE-2020-35534 | 0.00 | — | 0.00 | Sep 1, 2022 | In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files. | |||
| CVE-2020-35535 | 0.00 | — | 0.00 | Sep 1, 2022 | In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files. | |||
| CVE-2020-35530 | 0.00 | — | 0.00 | Sep 1, 2022 | In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file. | |||
| CVE-2020-35531 | 0.00 | — | 0.00 | Sep 1, 2022 | In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file. | |||
| CVE-2020-35532 | 0.00 | — | 0.00 | Sep 1, 2022 | In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field. | |||
| CVE-2020-24870 | 0.00 | — | 0.02 | Jun 2, 2021 | Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp. | |||
| CVE-2020-24889 | 0.00 | — | 0.01 | Sep 16, 2020 | A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution. | |||
| CVE-2020-24890 | 0.00 | — | 0.02 | Sep 16, 2020 | libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in a certain way | |||
| CVE-2020-15503 | 0.00 | — | 0.04 | Jul 2, 2020 | LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength. | |||
| CVE-2020-15365 | 0.00 | — | 0.01 | Jun 28, 2020 | LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds. | |||
| CVE-2015-8366 | 0.00 | — | 0.05 | Jan 14, 2020 | Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes. | |||
| CVE-2019-16214 | 0.00 | — | 0.01 | Sep 11, 2019 | Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with code auditing by using a nonstandard line-break character for a comment. For example, a Move module author can enter the // sequence (which… | |||
| CVE-2018-5817 | 0.00 | — | 0.03 | Feb 20, 2019 | A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop. | |||
| CVE-2018-5819 | 0.00 | — | 0.03 | Feb 20, 2019 | An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources. | |||
| CVE-2018-5818 | 0.00 | — | 0.02 | Feb 20, 2019 | An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop. | |||
| CVE-2018-20364 | 0.00 | — | 0.03 | Dec 22, 2018 | LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. | |||
| CVE-2018-20363 | 0.00 | — | 0.03 | Dec 22, 2018 | LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference. | |||
| CVE-2018-20365 | 0.00 | — | 0.03 | Dec 22, 2018 | LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow. |
- CVE-2021-32142Feb 17, 2023risk 0.00cvss —epss 0.00
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.
- CVE-2020-35533Sep 1, 2022risk 0.00cvss —epss 0.00
In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file.
- CVE-2020-35534Sep 1, 2022risk 0.00cvss —epss 0.00
In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
- CVE-2020-35535Sep 1, 2022risk 0.00cvss —epss 0.00
In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files.
- CVE-2020-35530Sep 1, 2022risk 0.00cvss —epss 0.00
In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.
- CVE-2020-35531Sep 1, 2022risk 0.00cvss —epss 0.00
In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file.
- CVE-2020-35532Sep 1, 2022risk 0.00cvss —epss 0.00
In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field.
- CVE-2020-24870Jun 2, 2021risk 0.00cvss —epss 0.02
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
- CVE-2020-24889Sep 16, 2020risk 0.00cvss —epss 0.01
A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution.
- CVE-2020-24890Sep 16, 2020risk 0.00cvss —epss 0.02
libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in a certain way
- CVE-2020-15503Jul 2, 2020risk 0.00cvss —epss 0.04
LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
- CVE-2020-15365Jun 28, 2020risk 0.00cvss —epss 0.01
LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds.
- CVE-2015-8366Jan 14, 2020risk 0.00cvss —epss 0.05
Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes.
- CVE-2019-16214Sep 11, 2019risk 0.00cvss —epss 0.01
Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with code auditing by using a nonstandard line-break character for a comment. For example, a Move module author can enter the // sequence (which…
- CVE-2018-5817Feb 20, 2019risk 0.00cvss —epss 0.03
A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop.
- CVE-2018-5819Feb 20, 2019risk 0.00cvss —epss 0.03
An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.
- CVE-2018-5818Feb 20, 2019risk 0.00cvss —epss 0.02
An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.
- CVE-2018-20364Dec 22, 2018risk 0.00cvss —epss 0.03
LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
- CVE-2018-20363Dec 22, 2018risk 0.00cvss —epss 0.03
LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a NULL pointer dereference.
- CVE-2018-20365Dec 22, 2018risk 0.00cvss —epss 0.03
LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer overflow.
Page 2 of 4