Vulnerabilities > Libraw
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-09-01 | CVE-2020-35533 | Out-of-bounds Read vulnerability in multiple products In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file. | 5.5 |
| 2022-09-01 | CVE-2020-35534 | Allocation of Resources Without Limits or Throttling vulnerability in Libraw In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files. | 5.5 |
| 2022-09-01 | CVE-2020-35535 | Out-of-bounds Read vulnerability in Libraw In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files. | 5.5 |
| 2021-06-02 | CVE-2020-24870 | Out-of-bounds Write vulnerability in Libraw Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp. | 8.8 |
| 2020-09-16 | CVE-2020-24890 | NULL Pointer Dereference vulnerability in Libraw 0.20.0 libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. | 5.5 |
| 2020-09-16 | CVE-2020-24889 | Classic Buffer Overflow vulnerability in Libraw A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution. | 7.8 |
| 2020-07-02 | CVE-2020-15503 | Improper Input Validation vulnerability in multiple products LibRaw before 0.20-RC1 lacks a thumbnail size range check. | 7.5 |
| 2020-06-28 | CVE-2020-15365 | Out-of-bounds Write vulnerability in Libraw 0.20 LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds. | 6.5 |
| 2020-01-14 | CVE-2015-8367 | Improper Initialization vulnerability in Libraw The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related to memory object initialization. | 9.8 |
| 2020-01-14 | CVE-2015-8366 | Improper Validation of Array Index vulnerability in Libraw Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and possibly execute arbitrary code via vectors related to indexes. | 9.8 |