CVE-2021-32142 : Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to es

Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp.

Published 2023-02-17 18:15:11

Updated 2023-05-28 04:15:10

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowMemory Corruption

Products affected by CVE-2021-32142

Libraw » Libraw » Version: 0.20.0
cpe:2.3:a:libraw:libraw:0.20.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-32142

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-32142

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-32142

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-32142

https://lists.debian.org/debian-lts-announce/2023/05/msg00025.html

[SECURITY] [DLA 3433-1] libraw security update

CVEs referencing this url
https://www.libraw.org/

About LibRaw | LibRaw
Product
https://github.com/LibRaw/LibRaw/issues/400

stack-buffer-over in libRaw · Issue #400 · LibRaw/LibRaw · GitHub
Exploit;Issue Tracking
https://www.debian.org/security/2023/dsa-5412

Debian -- Security Information -- DSA-5412-1 libraw

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E7TEZ7CLRNYYQZJ5NJGZXK6YJU46WH2L/

[SECURITY] Fedora 36 Update: mingw-LibRaw-0.20.2-8.fc36 - package-announce - Fedora Mailing-Lists
https://github.com/gtt1995

gtt1995 (taotao gu) · GitHub
Not Applicable
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5ICTVDRGBWGIFBTUWJLGX7QM5GWBWUG7/

[SECURITY] Fedora 37 Update: mingw-LibRaw-0.20.2-8.fc37 - package-announce - Fedora Mailing-Lists
https://github.com/LibRaw/LibRaw/commit/bc3aaf4223fdb70d52d470dae65c5a7923ea2a49

Patch

Jump to

Vulnerability Details : CVE-2021-32142

Products affected by CVE-2021-32142

Exploit prediction scoring system (EPSS) score for CVE-2021-32142

CVSS scores for CVE-2021-32142

CWE ids for CVE-2021-32142

References for CVE-2021-32142