CVE-2020-35532: Medium severity Libraw Libraw vulnerability
In LibRaw, an out-of-bounds read vulnerability exists within the "simpledecoderow()" function (libraw\src\x3f\x3futilspatched.cpp) which can be triggered via an image with a large rowstride field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librawto a version that resolves this vulnerability.Fixed in 0.20.2-1+deb11u1Fixed in 0.20.2-2.1Fixed in 0.21.3-1 - Upgrade
Upgrade
alpine/librawto a version that resolves this vulnerability.Fixed in 0.20.0-r0
Event History
Frequently Asked Questions
What is CVE-2020-35532?
CVE-2020-35532 is an out-of-bounds read vulnerability in LibRaw's simple_decode_row() function.
How does CVE-2020-35532 occur?
CVE-2020-35532 occurs when an image with a large row_stride field triggers an out-of-bounds read in the simple_decode_row() function.
What is the severity of CVE-2020-35532?
The severity of CVE-2020-35532 is medium with a severity value of 5.5.
Which software versions are affected by CVE-2020-35532?
Versions 0.20.0, 0.20.0-rc2, 0.20.1, 0.20.2, and 0.21.0-beta1 of Libraw are affected by CVE-2020-35532.
How can I fix CVE-2020-35532?
To fix CVE-2020-35532, users should update to a version of Libraw that includes the fix for the vulnerability.