CVE-2013-2126

2013-08-1415:55:06

Debian Security Bug Tracker

security-tracker.debian.org

libraw

double free

vulnerabilities

denial of service

arbitrary code

foveon

sraw

image file

application crash

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.019

Percentile

88.9%

JSON

Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.

OSVersionArchitecturePackageVersionFilename
Debian12alldarktable< 1.2.1-2darktable_1.2.1-2_all.deb
Debian11alldarktable< 1.2.1-2darktable_1.2.1-2_all.deb
Debian999alldarktable< 1.2.1-2darktable_1.2.1-2_all.deb
Debian13alldarktable< 1.2.1-2darktable_1.2.1-2_all.deb
Debian12alllibraw< 0.15.3-1libraw_0.15.3-1_all.deb
Debian11alllibraw< 0.15.3-1libraw_0.15.3-1_all.deb
Debian999alllibraw< 0.15.3-1libraw_0.15.3-1_all.deb
Debian13alllibraw< 0.15.3-1libraw_0.15.3-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	darktable	< 1.2.1-2	darktable_1.2.1-2_all.deb
Debian	11	all	darktable	< 1.2.1-2	darktable_1.2.1-2_all.deb
Debian	999	all	darktable	< 1.2.1-2	darktable_1.2.1-2_all.deb
Debian	13	all	darktable	< 1.2.1-2	darktable_1.2.1-2_all.deb
Debian	12	all	libraw	< 0.15.3-1	libraw_0.15.3-1_all.deb
Debian	11	all	libraw	< 0.15.3-1	libraw_0.15.3-1_all.deb
Debian	999	all	libraw	< 0.15.3-1	libraw_0.15.3-1_all.deb
Debian	13	all	libraw	< 0.15.3-1	libraw_0.15.3-1_all.deb