CVE-2020-15503: Input Validation
Last updated 24 July 2024
Other sources
LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpackthumb.cpp, postprocessing/memimage.cpp, and utils/thumbutils.cpp. For example, malloc(sizeof(librawprocessedimaget)+T.tlength) occurs without validating T.tlength.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-15503?
CVE-2020-15503 is a vulnerability in LibRaw before version 0.20-RC1 that lacks a thumbnail size range check.
Which components of LibRaw are affected by CVE-2020-15503?
The vulnerability affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp.
What is the severity of CVE-2020-15503?
The severity of CVE-2020-15503 is high, with a severity value of 7.5.
How can I fix CVE-2020-15503?
To fix CVE-2020-15503, you should upgrade to version 0.20 or later of LibRaw.
Where can I find more information about CVE-2020-15503?
You can find more information about CVE-2020-15503 on the following sources: [OpenSUSE Security Announce](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00075.html), [OpenSUSE Security Announce](http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00001.html), [GitHub Commit](https://github.com/LibRaw/LibRaw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d).