CVE-2020-15503 Integer overflow in n/a
An integer overflow in LibRaw's thumbnail processing allows attackers to cause denial of service or execute arbitrary code via crafted images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15503?
CVE-2020-15503 is a high-severity vulnerability in Debian Debian Linux, published on 2 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
Weakness: CWE-20
Which versions are affected by CVE-2020-15503?
It affects 3 products.
Linux distribution packages (6)
libraw SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 0.15.4-33.1 |
libraw SUSE:Linux Enterprise Workstation Extension 12 SP5 | All versions | 0.15.4-33.1 |
libraw SUSE:Linux Enterprise Workstation Extension 15 SP1 | All versions | 0.18.9-3.11.1 |
libraw SUSE:Linux Enterprise Workstation Extension 15 SP2 | All versions | 0.18.9-3.11.1 |
libraw openSUSE:Leap 15.1 | All versions | 0.18.9-lp151.4.3.1 |
libraw openSUSE:Leap 15.2 | All versions | 0.18.9-lp152.5.3.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Libraw Libraw.
How do I fix CVE-2020-15503?
Upgrade to a fixed version.
Is CVE-2020-15503 being exploited?
There is no known exploitation of CVE-2020-15503 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-44688, DEBIAN-CVE-2020-15503, DLA-3214-1, GHSA-2w4r-7g95-jpmw, MGASA-2020-0368, SUSE-SU-2020:2028-1 and 4 more.