CVE-2021-32142
LibRaw: stack buffer overflow in LibRaw_buffer_datastream::gets() in src/libraw_datastream.cpp
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.
A flaw was found in the LibRaw package. A stack buffer overflow in the LibRaw_buffer_datastream::gets() function in src/libraw_datastream.cpp caused by a maliciously crafted file may result in compromised confidentiality and integrity and an application crash.
Zinuo Han and Ao Wang discovered that the Android DNG SDK, vendored in digiKam, did not correctly parse certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. It was discovered that Platinum Upnp SDK, vendored in digiKam, was vulnerable to a path traversal attack. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2021-05-07 CVE Reserved
- 2023-02-17 CVE Published
- 2025-03-19 CVE Updated
- 2025-03-19 First Exploit
- 2025-04-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| https://github.com/gtt1995 | Not Applicable | |
| https://lists.debian.org/debian-lts-announce/2023/05/msg00025.html | Mailing List |
|
| https://www.libraw.org | Product |
| URL | Date | SRC |
|---|---|---|
| https://github.com/LibRaw/LibRaw/issues/400 | 2025-03-19 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/LibRaw/LibRaw/commit/bc3aaf4223fdb70d52d470dae65c5a7923ea2a49 | 2023-11-07 |