CVE-2021-32142 Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.
HighCVSS 7.8
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libraw(Debian:12) | < 0.20.2-2.1 | 0.20.2-2.1 |
| debian/libraw(Debian:13) | < 0.20.2-2.1 | 0.20.2-2.1 |
| debian/libraw(Debian:14) | < 0.20.2-2.1 | 0.20.2-2.1 |
| ubuntu/darktable(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/dcraw(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/exactimage(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libraw(Ubuntu:22.04) | < 0.20.2-2ubuntu2.22.04.1 | 0.20.2-2ubuntu2.22.04.1 |
| ubuntu/rawtherapee(Ubuntu:22.04) | All versions | No fix listed |
| LibRaw | = 0.20.0 | No fix listed |
| ubuntu/darktable(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/dcraw(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/exactimage(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/rawtherapee(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/darktable(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/dcraw(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/exactimage(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/rawtherapee(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/darktable(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/dcraw(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/exactimage(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/rawtherapee(Ubuntu:26.10) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2021-32142 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-6137-1 vendor-advisory
- USN-7266-1 vendor-advisory
- www.cve.org
- github.com patch
- github.com exploit issue-tracking
- github.com not-applicable
- [debian-lts-announce] 20230527 [SECURITY] [DLA 3433-1] libraw security update mailing-list
- FEDORA-2023-be842ba7fb vendor-advisory
- FEDORA-2023-220878f1bf vendor-advisory
- DSA-5412 vendor-advisory
- www.libraw.org product
- bugs.debian.org issue-tracking