CVE-2020-24889 — Classic Buffer Overflow in Libraw

CWE-120 — Classic Buffer Overflow9 documents6 sources

Severity

7.8HIGHNVD

EPSS

0.9%

top 23.82%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Libraw Debian Libraw

Timeline

PublishedSep 16

Latest updateMay 24

Description

A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDlibraw/libraw< 0.20.0

▶debiandebian/libraw< libraw 0.20.2-1 (bookworm)

▶Debianlibraw/libraw< 0.20.2-1+3

🔴Vulnerability Details

GHSA

GHSA-8977-8gpx-7fcv: A buffer overflow vulnerability in LibRaw version < 20↗2022-05-24

▶

OSV

CVE-2020-24889: A buffer overflow vulnerability in LibRaw version < 20↗2020-09-16

▶

📋Vendor Advisories

Red Hat

libraw: buffer overflow vulnerability in LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution↗2020-08-20

▶

Debian

CVE-2020-24889: libraw - A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedMo...↗2020

▶

💬Community

Bugzilla

CVE-2020-24889 LibRaw: buffer overflow vulnerability in LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution [fedora-all]↗2020-09-24

▶

Bugzilla

CVE-2020-24889 mingw-LibRaw: libraw: buffer overflow vulnerability in LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution [fedora-all]↗2020-09-24

▶

Bugzilla

CVE-2020-24889 libraw: buffer overflow vulnerability in LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution↗2020-09-24

▶

Bugzilla

CVE-2020-24889 LibRaw: buffer overflow vulnerability in LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution [epel-6]↗2020-09-24

▶