CVE-2020-35531: Medium severity Libraw Libraw vulnerability
In LibRaw, an out-of-bounds read vulnerability exists within the gethuffmandiff() function (libraw\src\x3f\x3futilspatched.cpp) when reading data from an image file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librawto a version that resolves this vulnerability.Fixed in 0.20.2-1+deb11u1Fixed in 0.20.2-2.1Fixed in 0.21.3-1 - Upgrade
Upgrade
alpine/librawto a version that resolves this vulnerability.Fixed in 0.20.0-r0
Event History
Frequently Asked Questions
What is CVE-2020-35531?
CVE-2020-35531 is an out-of-bounds read vulnerability in LibRaw's get_huffman_diff() function.
Where does the vulnerability exist?
The vulnerability exists within the get_huffman_diff() function in libraw\src\x3f\x3f_utils_patched.cpp.
What is the severity of CVE-2020-35531?
CVE-2020-35531 has a severity rating of 5.5 (medium).
Which versions of LibRaw are affected?
Versions 0.20.0, 0.20.0-rc2, 0.20.1, 0.20.2, and 0.21.0-beta1 of LibRaw are affected.
How do I fix CVE-2020-35531?
To fix CVE-2020-35531, update to a version of LibRaw that is not affected by the vulnerability.