CVE-2020-35530

2022-09-0118:15:08

CWE-787

[email protected]

web.nvd.nist.gov

libraw

out-of-bounds write

new_node

x3f file

vulnerability

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

35.0%

JSON

In LibRaw, there is an out-of-bounds write vulnerability within the “new_node()” function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.

Affected configurations

Nvd

Node

librawlibrawMatch0.20.0-

librawlibrawMatch0.20.0rc2

librawlibrawMatch0.20.1

librawlibrawMatch0.20.2

librawlibrawMatch0.21.0beta1

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
librawlibraw0.20.0cpe:2.3:a:libraw:libraw:0.20.0:-:*:*:*:*:*:*
librawlibraw0.20.0cpe:2.3:a:libraw:libraw:0.20.0:rc2:*:*:*:*:*:*
librawlibraw0.20.1cpe:2.3:a:libraw:libraw:0.20.1:*:*:*:*:*:*:*
librawlibraw0.20.2cpe:2.3:a:libraw:libraw:0.20.2:*:*:*:*:*:*:*
librawlibraw0.21.0cpe:2.3:a:libraw:libraw:0.21.0:beta1:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libraw	libraw	0.20.0	cpe:2.3:a:libraw:libraw:0.20.0:-::::::
libraw	libraw	0.20.0	cpe:2.3:a:libraw:libraw:0.20.0:rc2::::::
libraw	libraw	0.20.1	cpe:2.3:a:libraw:libraw:0.20.1:::::::*
libraw	libraw	0.20.2	cpe:2.3:a:libraw:libraw:0.20.2:::::::*
libraw	libraw	0.21.0	cpe:2.3:a:libraw:libraw:0.21.0:beta1::::::
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*