Medium: LibRaw

Issue Overview:

In LibRaw, an out-of-bounds read vulnerability exists within the “LibRaw::adobe_copy_pixel()” function (libraw\src\decoders\dng.cpp) when reading data from the image file. (CVE-2020-35533)

A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to application crash. (CVE-2023-1729)

Affected Packages:

LibRaw

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update LibRaw to update your system.

New Packages:

aarch64:  
    LibRaw-0.19.4-1.amzn2.0.1.aarch64  
    LibRaw-devel-0.19.4-1.amzn2.0.1.aarch64  
    LibRaw-static-0.19.4-1.amzn2.0.1.aarch64  
    LibRaw-debuginfo-0.19.4-1.amzn2.0.1.aarch64  
  
i686:  
    LibRaw-0.19.4-1.amzn2.0.1.i686  
    LibRaw-devel-0.19.4-1.amzn2.0.1.i686  
    LibRaw-static-0.19.4-1.amzn2.0.1.i686  
    LibRaw-debuginfo-0.19.4-1.amzn2.0.1.i686  
  
src:  
    LibRaw-0.19.4-1.amzn2.0.1.src  
  
x86_64:  
    LibRaw-0.19.4-1.amzn2.0.1.x86_64  
    LibRaw-devel-0.19.4-1.amzn2.0.1.x86_64  
    LibRaw-static-0.19.4-1.amzn2.0.1.x86_64  
    LibRaw-debuginfo-0.19.4-1.amzn2.0.1.x86_64  

Additional References

Red Hat: CVE-2020-35533, CVE-2023-1729

Mitre: CVE-2020-35533, CVE-2023-1729