LibRaw: Memory corruption in "crxFreeSubbandData()" function
Published Sep 1, 2022
5.5
MEDIUMCVSS 3.1
EPSS 0.26%
Description
In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.
Affected products
- Vendor n/a Product LibRaw Defaultn/a
- Version LibRaw 0.21-Beta1, LibRaw 0.20.2, LibRaw 0.20.1, LibRaw 0.20.0, LibRaw 0.20-RC2StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | LibRaw | n/a |
|
No data.
Red Hat Enterprise Linux 6
libraw1394
Out of support scope
Red Hat Enterprise Linux 7
LibRaw
Out of support scope
Red Hat Enterprise Linux 7
libraw1394
Out of support scope
Red Hat Enterprise Linux 8
LibRaw
Fix deferred
Red Hat Enterprise Linux 8
libraw1394
Not affected
Red Hat Enterprise Linux 8
libreoffice:flatpak/libraw1394
Not affected
Red Hat Enterprise Linux 9
LibRaw
Not affected
Red Hat Enterprise Linux 9
libreoffice:flatpak/libraw1394
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | libraw1394 | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | LibRaw | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | libraw1394 | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | LibRaw | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | libraw1394 | Not affected | n/a |
| Red Hat Enterprise Linux 8 | libreoffice:flatpak/libraw1394 | Not affected | n/a |
| Red Hat Enterprise Linux 9 | LibRaw | Not affected | n/a |
| Red Hat Enterprise Linux 9 | libreoffice:flatpak/libraw1394 | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (6)
- https://access.redhat.com/security/cve/CVE-2020-35534 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2122360 Issue Tracking
- https://github.com/LibRaw/LibRaw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8 x_refsource_MISCPatchThird Party Advisory
- https://github.com/LibRaw/LibRaw/issues/279 x_refsource_MISCIssue TrackingPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-35534
- https://www.cve.org/CVERecord?id=CVE-2020-35534
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-35534 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2122360 | Issue Tracking | |
| https://github.com/LibRaw/LibRaw/commit/e41f331e90b383e3208cefb74e006df44bf3a4b8 | x_refsource_MISCPatchThird Party Advisory | |
| https://github.com/LibRaw/LibRaw/issues/279 | x_refsource_MISCIssue TrackingPatchThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-35534 | ||
| https://www.cve.org/CVERecord?id=CVE-2020-35534 |
Change history (0)
No recorded changes yet.