CVE-2013-2126 Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and pos...
HighCVSS 7.5
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/darktable(Debian:12) | < 1.2.1-2 | 1.2.1-2 |
| debian/darktable(Debian:13) | < 1.2.1-2 | 1.2.1-2 |
| debian/darktable(Debian:14) | < 1.2.1-2 | 1.2.1-2 |
| debian/libkdcraw(Debian:13) | < 24.12.0-1 | 24.12.0-1 |
| debian/libkdcraw(Debian:14) | < 24.12.0-1 | 24.12.0-1 |
| debian/libraw(Debian:12) | < 0.15.3-1 | 0.15.3-1 |
| debian/libraw(Debian:13) | < 0.15.3-1 | 0.15.3-1 |
| debian/libraw(Debian:14) | < 0.15.3-1 | 0.15.3-1 |
| LibRaw | <= 0.15.1 | No fix listed |
| LibRaw | = 0.15.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.04 | No fix listed |
| opensuse | = 12.2 | No fix listed |
| opensuse | = 12.3 | No fix listed |
References
- Debian Security Tracker CVE-2013-2126 vendor-advisory
- openSUSE-SU-2013:1083 vendor-advisory
- openSUSE-SU-2013:1085 vendor-advisory
- 53547 third-party-advisory vendor-advisory
- 53883 third-party-advisory vendor-advisory
- 53888 third-party-advisory vendor-advisory
- 53938 third-party-advisory
- www.libraw.org
- [oss-security] 20130529 Re: CVE request: libraw: multiple issues mailing-list
- [oss-security] 20130610 Re: CVE request: libraw: multiple issues mailing-list
- USN-1884-1 vendor-advisory
- USN-1885-1 vendor-advisory
- github.com exploit patch
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking