CVE-2018-20365: Buffer Overflow

Reference Links

• https://github.com/LibRaw/LibRaw/issues/195
• http://www.securityfocus.com/bid/106299
• https://usn.ubuntu.com/3989-1/
• https://launchpad.net/bugs/cve/CVE-2018-20365
• https://github.com/LibRaw/LibRaw/commit/7e29b9f29449fde30cc878fbb137d61c14bba3a4
• https://github.com/LibRaw/LibRaw/commit/a7c17cb6bbec1e79f058d84511f9c3b142cbdfa7
• https://security-tracker.debian.org/tracker/CVE-2018-20365
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20365
• https://ubuntu.com/security/notices/USN-3989-1
• https://nvd.nist.gov/vuln/detail/CVE-2018-20365
• https://github.com/LibRaw/LibRaw/commit/9b5c50d5fdf6d1386a31f08ecdae3a752fe63d07
• https://ubuntu.com/security/CVE-2018-20365

Parent vulnerabilities

(Appears in the following advisories)

• USN-3989-1

Frequently Asked Questions

• What is CVE-2018-20365?

  CVE-2018-20365 is a vulnerability in LibRaw::raw2image() in libraw_cxx.cpp that allows for a heap-based buffer overflow.

• How severe is CVE-2018-20365?

  CVE-2018-20365 has a severity of 6.5 (Medium).

• Which software is affected by CVE-2018-20365?

  Libraw version 0.19.2-2, 0.19.2-2+deb10u4, 0.20.2-1+deb11u1, 0.20.2-2.1, and 0.21.1-7 are affected on Debian. libraw version 0.18.8-1ubuntu0.3, 0.18.13-1ubuntu0.1, 0.19.2-2, and 0.17.1-1ubuntu0.5 are affected on Ubuntu. The vulnerability affects Libraw version up to and including 0.19.1 on all platforms.

• How do I fix CVE-2018-20365 on Debian?

  Apply the following remedies on Debian: libraw version 0.19.2-2 or later.

• How do I fix CVE-2018-20365 on Ubuntu?

  Apply the following remedies on Ubuntu: libraw version 0.18.8-1ubuntu0.3, 0.18.13-1ubuntu0.1, 0.19.2-2, or 0.17.1-1ubuntu0.5.