CVE-2020-24890

Published: Sep 16, 2020Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in a certain way

Affected (1)

Products: Libraw: Libraw

Libraw

1 product

Libraw

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libraw Libraw	Version 0.20.0

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (6)

https://github.com/LibRaw/LibRaw/issues/335

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWHUZCRMGOC3QS6C65KWBM6ZJM25V6HI/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202010-05

Source: cve@mitre.org

https://github.com/LibRaw/LibRaw/issues/335

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWHUZCRMGOC3QS6C65KWBM6ZJM25V6HI/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202010-05

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.