CVE-2020-35530: Medium severity Libraw Libraw vulnerability
In LibRaw, there is an out-of-bounds write vulnerability within the "newnode()" function (libraw\src\x3f\x3futilspatched.cpp) that can be triggered via a crafted X3F file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librawto a version that resolves this vulnerability.Fixed in 0.20.2-1+deb11u1Fixed in 0.20.2-2.1Fixed in 0.21.3-1 - Upgrade
Upgrade
alpine/librawto a version that resolves this vulnerability.Fixed in 0.20.0-r0
Event History
Frequently Asked Questions
What is CVE-2020-35530?
CVE-2020-35530 is an out-of-bounds write vulnerability in LibRaw.
How can I trigger the vulnerability in LibRaw?
The vulnerability in LibRaw can be triggered by using a crafted X3F file.
Which versions of LibRaw are affected by CVE-2020-35530?
Versions 0.20.0, 0.20.0-rc2, 0.20.1, 0.20.2, and 0.21.0-beta1 of LibRaw are affected.
What is the severity of CVE-2020-35530?
CVE-2020-35530 has a severity rating of 5.5 (medium).
How can I fix the vulnerability in LibRaw?
To fix the vulnerability, you should update LibRaw to a version that is not affected by CVE-2020-35530.