// For flags

CVE-2020-15503

LibRaw: lack of thumbnail size range check can lead to buffer overflow

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.

LibRaw versiones anteriores a 0.20-RC1, carece de una comprobación de rango de tamaño de miniaturas. Esto afecta a los archivos decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, y utils/thumb_utils.cpp. Por ejemplo, malloc(sizeof(libraw_processed_image_t)+T.tlength) ocurre sin comprobar T.tlength

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-07-02 CVE Reserved
  • 2020-07-02 CVE Published
  • 2024-06-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CAPEC
References (14)
URL Tag Source
https://github.com/LibRaw/LibRaw/compare/0.20-Beta3...0.20-RC1 Release Notes
https://lists.debian.org/debian-lts-announce/2022/11/msg00042.html Mailing List
https://www.libraw.org/news/libraw-0-20-rc1 Broken Link
URL Date SRC
URL Date SRC
https://github.com/LibRaw/LibRaw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d 2023-11-07
URL Date SRC
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00075.html 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00001.html 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HM2DS6HA4YZREI3BYGS75M6D76WMW62 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSXAJKZ4VNDYVQULJNY4XDPWHIJDTB4P 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNGDWTO45TU4KGND75EUUEGUMNSOYC7H 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCVKD7PTO7UQAVUTBHJAKBKYLPQQGAMZ 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y34ALB34P3NGQXLF7BG7R6DGRX6XL2JN 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZETDVPZQWZWVGIG6JTIEKP5KPVMUE7Y 2023-11-07
https://access.redhat.com/security/cve/CVE-2020-15503 2020-11-04
https://bugzilla.redhat.com/show_bug.cgi?id=1853477 2020-11-04
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Libraw
Search vendor "Libraw"
 Libraw
Search vendor "Libraw" for product "Libraw"
 <= 0.19.5
Search vendor "Libraw" for product "Libraw" and version " <= 0.19.5"
-
Affected
Libraw
Search vendor "Libraw"
 Libraw
Search vendor "Libraw" for product "Libraw"
 0.20
Search vendor "Libraw" for product "Libraw" and version "0.20"
beta1
Affected
Libraw
Search vendor "Libraw"
 Libraw
Search vendor "Libraw" for product "Libraw"
 0.20
Search vendor "Libraw" for product "Libraw" and version "0.20"
beta2
Affected
Libraw
Search vendor "Libraw"
 Libraw
Search vendor "Libraw" for product "Libraw"
 0.20
Search vendor "Libraw" for product "Libraw" and version "0.20"
beta3
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 31
Search vendor "Fedoraproject" for product "Fedora" and version "31"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 32
Search vendor "Fedoraproject" for product "Fedora" and version "32"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 10.0
Search vendor "Debian" for product "Debian Linux" and version "10.0"
-
Affected