CVE-2018-20337 There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.
HighCVSS 8.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libraw(Debian:12) | < 0.19.2-1 | 0.19.2-1 |
| debian/libraw(Debian:13) | < 0.19.2-1 | 0.19.2-1 |
| debian/libraw(Debian:14) | < 0.19.2-1 | 0.19.2-1 |
| LibRaw | = 0.19.1 | No fix listed |
| ubuntu/darktable(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/dcraw(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/exactimage(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/rawtherapee(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/darktable(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/dcraw(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/exactimage(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/rawtherapee(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/darktable(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/dcraw(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/exactimage(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/rawtherapee(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/darktable(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/dcraw(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/exactimage(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/rawtherapee(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-3989-1 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-20337 vendor-advisory
- github.com exploit patch third-party-advisory
- USN-3989-1 vendor-advisory
- bugs.debian.org issue-tracking