CVE-2020-15503: Input Validation
First published: Thu Jul 02 2020(Updated: )
Last updated 24 July 2024
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/LibRaw | <0.20 | 0.20 |
| debian/libraw | 0.20.2-1+deb11u1 0.20.2-2.1 0.21.3-1 | |
| Libraw | <=0.19.5 | |
| Libraw | =0.20-beta1 | |
| Libraw | =0.20-beta2 | |
| Libraw | =0.20-beta3 | |
| Fedora | =31 | |
| Fedora | =32 | |
| Debian | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/LibRaw/LibRaw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1853478
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1853479
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1699874&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1699874&action=edit
- https://access.redhat.com/errata/RHSA-2020:4451
- https://access.redhat.com/security/cve/cve-2020-15503
- https://bugzilla.redhat.com/show_bug.cgi?id=1853477
- https://www.libraw.org/news/libraw-0-20-rc1
- https://github.com/LibRaw/LibRaw/compare/0.20-Beta3...0.20-RC1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNGDWTO45TU4KGND75EUUEGUMNSOYC7H/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSXAJKZ4VNDYVQULJNY4XDPWHIJDTB4P/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCVKD7PTO7UQAVUTBHJAKBKYLPQQGAMZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HM2DS6HA4YZREI3BYGS75M6D76WMW62/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00075.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y34ALB34P3NGQXLF7BG7R6DGRX6XL2JN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZETDVPZQWZWVGIG6JTIEKP5KPVMUE7Y/
- https://lists.debian.org/debian-lts-announce/2022/11/msg00042.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HM2DS6HA4YZREI3BYGS75M6D76WMW62/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSXAJKZ4VNDYVQULJNY4XDPWHIJDTB4P/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNGDWTO45TU4KGND75EUUEGUMNSOYC7H/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QCVKD7PTO7UQAVUTBHJAKBKYLPQQGAMZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y34ALB34P3NGQXLF7BG7R6DGRX6XL2JN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZETDVPZQWZWVGIG6JTIEKP5KPVMUE7Y/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15503
- https://nvd.nist.gov/vuln/detail/CVE-2020-15503
- https://launchpad.net/bugs/cve/CVE-2020-15503
- https://security-tracker.debian.org/tracker/CVE-2020-15503
- https://ubuntu.com/security/CVE-2020-15503
Frequently Asked Questions
What is CVE-2020-15503?
CVE-2020-15503 is a vulnerability in LibRaw before version 0.20-RC1 that lacks a thumbnail size range check.
Which components of LibRaw are affected by CVE-2020-15503?
The vulnerability affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp.
What is the severity of CVE-2020-15503?
The severity of CVE-2020-15503 is high, with a severity value of 7.5.
How can I fix CVE-2020-15503?
To fix CVE-2020-15503, you should upgrade to version 0.20 or later of LibRaw.
Where can I find more information about CVE-2020-15503?
You can find more information about CVE-2020-15503 on the following sources: [OpenSUSE Security Announce](http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00075.html), [OpenSUSE Security Announce](http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00001.html), [GitHub Commit](https://github.com/LibRaw/LibRaw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d).
- agent/type
- agent/author
- agent/severity
- agent/remedy
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-15503
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- collector/usn-cve
- source/Ubuntu
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- agent/references
- agent/source
- agent/description
- agent/event
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- package-manager/redhat
- package-manager/debian
- vendor/libraw
- canonical/libraw
- version/libraw/0.19.5
- version/libraw/0.20-beta1
- version/libraw/0.20-beta2
- version/libraw/0.20-beta3
- vendor/fedoraproject
- canonical/fedora
- version/fedora/31
- version/fedora/32
- vendor/debian
- canonical/debian
- version/debian/10.0