CVE-2020-35530
published 2022-09-01CVE-2020-35530: In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a…
PriorityP421medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.37%
29.5th percentile
In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | libraw | < libraw 0.20.0-4 (bookworm) | libraw 0.20.0-4 (bookworm) |
| libraw | libraw | — | — |
| libraw | libraw | — | — |
| libraw | libraw | — | — |
| libraw | libraw | — | — |
| libraw | libraw | — | — |
| libraw | libraw | >= 0 < 0.20.0-4 | 0.20.0-4 |
| libraw | libraw | >= 0 < 0.20.0-4 | 0.20.0-4 |
| libraw | libraw | >= 0 < 0.20.0-4 | 0.20.0-4 |
| libraw | libraw | >= 0 < 0.20.0-4 | 0.20.0-4 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
digikam vulnerabilities
osv·2025-02-13·CVSS 5.5
CVE-2017-0691 [MEDIUM] digikam vulnerabilities
digikam vulnerabilities
Zinuo Han and Ao Wang discovered that the Android DNG SDK, vendored in
digiKam, did not correctly parse certain files. An attacker could possibly
use this issue to execute arbitrary code. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2017-0691)
It was discovered that Platinum Upnp SDK, vendored in digiKam, was
vulnerable to a path traversal attack. An attacker could possibly use this
issue to leak sensitive information. This issue only affected
Ubuntu 20.04 LTS. (CVE-2020-19858)
It was discovered that LibRaw, vendored in digiKam, did not correctly
handle certain memory operations. If a user or automated system were
tricked into opening a specially crafted file, an attacker could possibly
use this issue to leak sensitive in
GHSA
GHSA-gf6q-7pjq-pfq7: In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched
ghsa_unreviewed·2022-09-02
CVE-2020-35530 [MEDIUM] CWE-787 GHSA-gf6q-7pjq-pfq7: In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched
In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.
OSV
CVE-2020-35530: In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched
osv·2022-09-01·CVSS 5.5
CVE-2020-35530 [MEDIUM] CVE-2020-35530: In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched
In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.
Ubuntu
digiKam vulnerabilities
vendor_ubuntu·2025-02-13·CVSS 5.5
CVE-2020-35531 [MEDIUM] digiKam vulnerabilities
Title: digiKam vulnerabilities
Summary: Several security issues were fixed in digiKam.
Zinuo Han and Ao Wang discovered that the Android DNG SDK, vendored in
digiKam, did not correctly parse certain files. An attacker could possibly
use this issue to execute arbitrary code. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2017-0691)
It was discovered that Platinum Upnp SDK, vendored in digiKam, was
vulnerable to a path traversal attack. An attacker could possibly use this
issue to leak sensitive information. This issue only affected
Ubuntu 20.04 LTS. (CVE-2020-19858)
It was discovered that LibRaw, vendored in digiKam, did not correctly
handle certain memory operations. If a user or automated system were
tricked into opening a specially crafted file
Ubuntu
LibRaw vulnerabilities
vendor_ubuntu·2022-11-07
CVE-2020-15503 LibRaw vulnerabilities
Title: LibRaw vulnerabilities
Summary: Several security issues were fixed in LibRaw.
It was discovered that LibRaw incorrectly handled photo files. If a user or
automated system were tricked into processing a specially crafted photo
file, a remote attacker could cause applications linked against LibRaw to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Instructions: After a standard system update you need to restart your session to make all
the necessary changes.
Red Hat
LibRaw: Out of bounds write in new_node() function
vendor_redhat·2020-04-03·CVSS 5.5
CVE-2020-35530 [MEDIUM] CWE-787 LibRaw: Out of bounds write in new_node() function
LibRaw: Out of bounds write in new_node() function
In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.
A vulnerability was found in LibRaw. An out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) can be triggered via a crafted X3F file.
Package: libraw1394 (Red Hat Enterprise Linux 6) - Out of support scope
Package: libkdcraw (Red Hat Enterprise Linux 7) - Out of support scope
Package: LibRaw (Red Hat Enterprise Linux 7) - Out of support scope
Package: libraw1394 (Red Hat Enterprise Linux 7) - Out of support scope
Package: LibRaw (Red Hat Enterprise Linux 8) - Not affected
Package: libraw1394 (Red Hat Enterpr
Debian
CVE-2020-35530: libraw - In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()"...
vendor_debian·2020·CVSS 5.5
CVE-2020-35530 [MEDIUM] CVE-2020-35530: libraw - In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()"...
In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.
Scope: local
bookworm: resolved (fixed in 0.20.0-4)
bullseye: resolved (fixed in 0.20.0-4)
forky: resolved (fixed in 0.20.0-4)
sid: resolved (fixed in 0.20.0-4)
trixie: resolved (fixed in 0.20.0-4)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/LibRaw/LibRaw/commit/11c4db253ef2c9bb44247b578f5caa57c66a1eebhttps://github.com/LibRaw/LibRaw/issues/272https://lists.debian.org/debian-lts-announce/2022/09/msg00024.htmlhttps://github.com/LibRaw/LibRaw/commit/11c4db253ef2c9bb44247b578f5caa57c66a1eebhttps://github.com/LibRaw/LibRaw/issues/272https://lists.debian.org/debian-lts-announce/2022/09/msg00024.html
2022-09-01
Published