LibRaw: Out-of-bounds read in LibRaw::parseSonySRF() function
Published Sep 1, 2022
5.5
MEDIUMCVSS 3.1
EPSS 0.33%
Description
In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files.
Affected products
- Vendor n/a Product LibRaw Defaultn/a
- Version LibRaw 0.21-Beta1, LibRaw 0.20.2, LibRaw 0.20.1, LibRaw 0.20.0, LibRaw 0.20-RC2StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | LibRaw | n/a |
|
No data.
Red Hat Enterprise Linux 6
libraw1394
Out of support scope
Red Hat Enterprise Linux 7
LibRaw
Out of support scope
Red Hat Enterprise Linux 7
libraw1394
Out of support scope
Red Hat Enterprise Linux 8
LibRaw
Not affected
Red Hat Enterprise Linux 8
libraw1394
Not affected
Red Hat Enterprise Linux 8
libreoffice:flatpak/libraw1394
Not affected
Red Hat Enterprise Linux 9
LibRaw
Not affected
Red Hat Enterprise Linux 9
libreoffice:flatpak/libraw1394
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | libraw1394 | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | LibRaw | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | libraw1394 | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | LibRaw | Not affected | n/a |
| Red Hat Enterprise Linux 8 | libraw1394 | Not affected | n/a |
| Red Hat Enterprise Linux 8 | libreoffice:flatpak/libraw1394 | Not affected | n/a |
| Red Hat Enterprise Linux 9 | LibRaw | Not affected | n/a |
| Red Hat Enterprise Linux 9 | libreoffice:flatpak/libraw1394 | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (6)
- https://access.redhat.com/security/cve/CVE-2020-35535 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2122362 Issue Tracking
- https://github.com/LibRaw/LibRaw/commit/c243f4539233053466c1309bde606815351bee81 x_refsource_MISCPatchThird Party Advisory
- https://github.com/LibRaw/LibRaw/issues/283 x_refsource_MISCExploitIssue TrackingPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-35535
- https://www.cve.org/CVERecord?id=CVE-2020-35535
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-35535 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2122362 | Issue Tracking | |
| https://github.com/LibRaw/LibRaw/commit/c243f4539233053466c1309bde606815351bee81 | x_refsource_MISCPatchThird Party Advisory | |
| https://github.com/LibRaw/LibRaw/issues/283 | x_refsource_MISCExploitIssue TrackingPatchThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-35535 | ||
| https://www.cve.org/CVERecord?id=CVE-2020-35535 |
Change history (0)
No recorded changes yet.