CVE-2020-35535: Medium severity Libraw Libraw vulnerability
In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/librawto a version that resolves this vulnerability.Fixed in 0.20.0-r0
Event History
Frequently Asked Questions
What is CVE-2020-35535?
CVE-2020-35535 is an out-of-bounds read vulnerability in LibRaw's parseSonySRF() function when processing srf files.
How does CVE-2020-35535 affect LibRaw?
CVE-2020-35535 affects LibRaw versions 0.20.0 to 0.20.2 and 0.21.0-beta1. It allows an attacker to read data outside the bounds of an allocated buffer, potentially leading to information disclosure or denial of service.
What is the severity of CVE-2020-35535?
CVE-2020-35535 has a severity rating of 5.5 (medium).
How can I fix CVE-2020-35535?
To fix CVE-2020-35535, upgrade to LibRaw version 0.20.3 or later.
Where can I find more information about CVE-2020-35535?
You can find more information about CVE-2020-35535 at the following references: [GitHub Commit](https://github.com/LibRaw/LibRaw/commit/c243f4539233053466c1309bde606815351bee81) and [GitHub Issue](https://github.com/LibRaw/LibRaw/issues/283).