LibRaw Stack Buffer Overflow Vulnerability
Summary
ALSA-2023:6343: Moderate: LibRaw security update. Affects LibRaw versions < 0.20.2-6.el9. Fixed in 0.20.2-6.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibRaw is a library designed for reading RAW files from digital photo cameras. It supports various file formats such as CRW/CR2, NEF, RAF, and DNG. The library provides functionality to extract and process data from these files. However, a vulnerability has been discovered in LibRaw that could allow an attacker to trigger a stack buffer overflow.
Vulnerability Detail
The vulnerability (CVE-2021-32142) exists in the LibRaw_buffer_datastream::gets() function in the src/libraw_datastream.cpp file. Due to improper input validation, an attacker can exploit this vulnerability by providing a specially crafted input, leading to a stack buffer overflow. This could potentially result in arbitrary code execution or a denial of service condition. The impact of this vulnerability is considered moderate.
How To Fix
Minimum fixed version
0.20.2-6.el9
This is the first release that contains the fix.
sudo dnf update LibRawTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of LibRaw to mitigate the risk.
Conclusion
The LibRaw stack buffer overflow vulnerability (CVE-2021-32142) poses a moderate risk to systems using the affected versions of LibRaw. To mitigate this vulnerability, it is crucial to update to version 0.20.2-6.el9 or later. Applying the necessary security updates will ensure that the stack buffer overflow issue is addressed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for LibRaw →
FAQ
LibRaw is a library used for reading RAW files from digital photo cameras. It supports various file formats and provides functionality to extract and process data from these files.
The vulnerability could allow an attacker to trigger a stack buffer overflow, potentially leading to arbitrary code execution or a denial of service condition. The impact is considered moderate.
To fix this vulnerability, update LibRaw to version 0.20.2-6.el9 or later. Apply any available security updates to ensure you are using the latest patched version.
No, there is no known workaround for this vulnerability. Updating to the patched version of LibRaw is necessary to mitigate the risk.
You can find more information about this vulnerability, including the CVE identifier, in the AlmaLinux Release Notes linked in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for LibRaw.
