CVE-2018-20337

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in...

8.8 HighFix available

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.15%Up 1.4 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

Record: CVE-2018-20337
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

Record: CVE-2018-20337
Updated: 2026-11-02

EUVDEUVD-2018-12895 No score

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

Record: EUVD-2018-12895
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c9h6-p6mv-6rr7 8.8

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in...

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

Record: GHSA-c9h6-p6mv-6rr7
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 8.8

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

Record: CVE-2018-20337
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-20337 8.8

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

Record: DEBIAN-CVE-2018-20337
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVRHSA-2020:1766 6.4

Red Hat Security Advisory: GNOME security, bug fix, and enhancement update

Record: RHSA-2020:1766
CVSS 3.0: 6.4 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRLSA-2020:1766 6.4

Moderate: GNOME security, bug fix, and enhancement update

GNOME is the default desktop environment of Rocky Linux.

Security Fix(es):

LibRaw: stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp (CVE-2018-20337)
gdm: lock screen bypass when timed login is enabled (CVE-2019-3825)
gvfs: mishandling of file ownership in daemon/gvfsbackendadmin.c (CVE-2019-12447)
gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing query_info_on_read/write (CVE-2019-12448)
gvfs: mishandling of file's user and group ownership in daemon/gvfsbackendadmin.c due to unavailability of root privileges (CVE-2019-12449)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

Record: RLSA-2020:1766
CVSS 3.0: 6.4 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-20337 8.8

There is a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp in LibRaw 0.19.1. Crafted input will lead to a denial of service or possibly unspecified other impact.

Record: UBUNTU-CVE-2018-20337
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2020:1766 No score

Moderate: GNOME security, bug fix, and enhancement update

GNOME is the default desktop environment of AlmaLinux.

Security Fix(es):

LibRaw: stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp (CVE-2018-20337)
gdm: lock screen bypass when timed login is enabled (CVE-2019-3825)
gvfs: mishandling of file ownership in daemon/gvfsbackendadmin.c (CVE-2019-12447)
gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing query_info_on_read/write (CVE-2019-12448)
gvfs: mishandling of file's user and group ownership in daemon/gvfsbackendadmin.c due to unavailability of root privileges (CVE-2019-12449)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2020:1766
Updated: 2026-11-05

OSVopenSUSE-SU-2019:0094-1 No score

Security update for libraw

This update for libraw fixes the following issues:

Security issues fixed:

CVE-2018-20337: Fixed a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp (bsc#1120519)
CVE-2018-20365: Fixed a heap-based buffer overflow in the raw2image function of libraw_cxx.cpp (bsc#1120500)
CVE-2018-20364: Fixed a NULL pointer dereference in the copy_bayer function of libraw_cxx.cpp (bsc#1120499)
CVE-2018-20363: Fixed a NULL pointer dereference in the raw2image function of libraw_cxx.cpp (bsc#1120498)
CVE-2018-5817: Fixed an infinite loop in the unpacked_load_raw function of dcraw_common.cpp (bsc#1120515)
CVE-2018-5818: Fixed an infinite loop in the parse_rollei function of dcraw_common.cpp (bsc#1120516)
CVE-2018-5819: Fixed a denial of service in the parse_sinar_ia function of dcraw_common.cpp (bsc#1120517)

This update was imported from the SUSE:SLE-15:Update update project.

Record: openSUSE-SU-2019:0094-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10980-1 No score

libraw-devel-0.20.2-4.1 on GA media

These are all security issues fixed in the libraw-devel-0.20.2-4.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10980-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0133-1 No score

Security update for libraw

This update for libraw fixes the following issues:

Security issues fixed:

CVE-2018-20337: Fixed a stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp (bsc#1120519)
CVE-2018-20365: Fixed a heap-based buffer overflow in the raw2image function of libraw_cxx.cpp (bsc#1120500)
CVE-2018-20364: Fixed a NULL pointer dereference in the copy_bayer function of libraw_cxx.cpp (bsc#1120499)
CVE-2018-20363: Fixed a NULL pointer dereference in the raw2image function of libraw_cxx.cpp (bsc#1120498)
CVE-2018-5817: Fixed an infinite loop in the unpacked_load_raw function of dcraw_common.cpp (bsc#1120515)
CVE-2018-5818: Fixed an infinite loop in the parse_rollei function of dcraw_common.cpp (bsc#1120516)
CVE-2018-5819: Fixed a denial of service in the parse_sinar_ia function of dcraw_common.cpp (bsc#1120517)

Record: SUSE-SU-2019:0133-1
Updated: 2026-11-02

OSVUSN-3989-1 No score

libraw vulnerabilities

It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, a remote attacker could cause applications linked against LibRaw to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record: USN-3989-1
Updated: 2026-11-02

Affected products

libraw

Affected packages

Affected packages
Package	Affected	Fixed
`accountsservice-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 0.6.50-8.el8	0.6.50-8.el8
`baobab` AlmaLinux:8 From an advisory covering 5 CVEs	before 3.28.0-4.el8	3.28.0-4.el8
`clutter` AlmaLinux:8 From an advisory covering 5 CVEs	before 1.26.2-8.el8	1.26.2-8.el8
`clutter-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 1.26.2-8.el8	1.26.2-8.el8
`clutter-doc` AlmaLinux:8 From an advisory covering 5 CVEs	before 1.26.2-8.el8	1.26.2-8.el8
`gjs-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 1.56.2-4.el8	1.56.2-4.el8
`gnome-menus` AlmaLinux:8 From an advisory covering 5 CVEs	before 3.13.3-11.el8	3.13.3-11.el8
`gnome-menus-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 3.13.3-11.el8	3.13.3-11.el8
`gnome-tweaks` AlmaLinux:8 From an advisory covering 5 CVEs	before 3.28.1-7.el8	3.28.1-7.el8
`mozjs52` AlmaLinux:8 From an advisory covering 5 CVEs	before 52.9.0-2.el8.alma	52.9.0-2.el8.alma

Show 260 moreShow less

Affected packages
Package	Affected	Fixed
`mozjs52` AlmaLinux:8 From an advisory covering 5 CVEs	before 52.9.0-2.el8	52.9.0-2.el8
`mozjs52-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 52.9.0-2.el8.alma	52.9.0-2.el8.alma
`mozjs52-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 52.9.0-2.el8	52.9.0-2.el8
`mozjs60` AlmaLinux:8 From an advisory covering 5 CVEs	before 60.9.0-4.el8.alma	60.9.0-4.el8.alma
`mozjs60` AlmaLinux:8 From an advisory covering 5 CVEs	before 60.9.0-4.el8	60.9.0-4.el8
`mozjs60-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 60.9.0-4.el8	60.9.0-4.el8
`mozjs60-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 60.9.0-4.el8.alma	60.9.0-4.el8.alma
`vala` AlmaLinux:8 From an advisory covering 5 CVEs	before 0.40.19-1.el8	0.40.19-1.el8
`vala-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 0.40.19-1.el8	0.40.19-1.el8
`libraw` Debian:12	before 0.19.2-1	0.19.2-1
`libraw` Debian:13	before 0.19.2-1	0.19.2-1
`libraw` Debian:14	before 0.19.2-1	0.19.2-1
`LibRaw` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.19.5-1.el8	0:0.19.5-1.el8
`LibRaw-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.19.5-1.el8	0:0.19.5-1.el8
`LibRaw-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.19.5-1.el8	0:0.19.5-1.el8
`LibRaw-samples-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.19.5-1.el8	0:0.19.5-1.el8
`accountsservice` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.6.50-8.el8	0:0.6.50-8.el8
`accountsservice-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.6.50-8.el8	0:0.6.50-8.el8
`accountsservice-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.6.50-8.el8	0:0.6.50-8.el8
`accountsservice-libs` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.6.50-8.el8	0:0.6.50-8.el8
`accountsservice-libs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.6.50-8.el8	0:0.6.50-8.el8
`appstream-data` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:8-20191129.el8	0:8-20191129.el8
`baobab` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.0-4.el8	0:3.28.0-4.el8
`baobab-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.0-4.el8	0:3.28.0-4.el8
`baobab-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.0-4.el8	0:3.28.0-4.el8
`clutter` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`clutter-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`clutter-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`clutter-tests-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`evince` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.4-4.el8	0:3.28.4-4.el8
`evince-browser-plugin` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.4-4.el8	0:3.28.4-4.el8
`evince-browser-plugin-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.4-4.el8	0:3.28.4-4.el8
`evince-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.4-4.el8	0:3.28.4-4.el8
`evince-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.4-4.el8	0:3.28.4-4.el8
`evince-libs` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.4-4.el8	0:3.28.4-4.el8
`evince-libs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.4-4.el8	0:3.28.4-4.el8
`evince-nautilus` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.4-4.el8	0:3.28.4-4.el8
`evince-nautilus-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.4-4.el8	0:3.28.4-4.el8
`gdm` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:3.28.3-29.el8	1:3.28.3-29.el8
`gdm-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:3.28.3-29.el8	1:3.28.3-29.el8
`gdm-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:3.28.3-29.el8	1:3.28.3-29.el8
`gjs` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.56.2-4.el8	0:1.56.2-4.el8
`gjs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.56.2-4.el8	0:1.56.2-4.el8
`gjs-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.56.2-4.el8	0:1.56.2-4.el8
`gjs-tests-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.56.2-4.el8	0:1.56.2-4.el8
`gnome-boxes` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.5-8.el8	0:3.28.5-8.el8
`gnome-boxes-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.5-8.el8	0:3.28.5-8.el8
`gnome-boxes-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.5-8.el8	0:3.28.5-8.el8
`gnome-control-center` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.2-19.el8	0:3.28.2-19.el8
`gnome-control-center-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.2-19.el8	0:3.28.2-19.el8
`gnome-control-center-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.2-19.el8	0:3.28.2-19.el8
`gnome-control-center-filesystem` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.2-19.el8	0:3.28.2-19.el8
`gnome-menus` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.13.3-11.el8	0:3.13.3-11.el8
`gnome-menus-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.13.3-11.el8	0:3.13.3-11.el8
`gnome-menus-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.13.3-11.el8	0:3.13.3-11.el8
`gnome-online-accounts` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.2-1.el8	0:3.28.2-1.el8
`gnome-online-accounts-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.2-1.el8	0:3.28.2-1.el8
`gnome-online-accounts-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.2-1.el8	0:3.28.2-1.el8
`gnome-online-accounts-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.2-1.el8	0:3.28.2-1.el8
`gnome-remote-desktop` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.1.6-8.el8	0:0.1.6-8.el8
`gnome-remote-desktop-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.1.6-8.el8	0:0.1.6-8.el8
`gnome-remote-desktop-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.1.6-8.el8	0:0.1.6-8.el8
`gnome-session` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-8.el8	0:3.28.1-8.el8
`gnome-session-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-8.el8	0:3.28.1-8.el8
`gnome-session-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-8.el8	0:3.28.1-8.el8
`gnome-session-wayland-session` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-8.el8	0:3.28.1-8.el8
`gnome-session-xsession` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-8.el8	0:3.28.1-8.el8
`gnome-settings-daemon` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.0-9.el8	0:3.32.0-9.el8
`gnome-settings-daemon-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.0-9.el8	0:3.32.0-9.el8
`gnome-settings-daemon-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.0-9.el8	0:3.32.0-9.el8
`gnome-shell` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.2-14.el8	0:3.32.2-14.el8
`gnome-shell-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.2-14.el8	0:3.32.2-14.el8
`gnome-shell-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.2-14.el8	0:3.32.2-14.el8
`gnome-software` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.30.6-3.el8	0:3.30.6-3.el8
`gnome-software-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.30.6-3.el8	0:3.30.6-3.el8
`gnome-software-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.30.6-3.el8	0:3.30.6-3.el8
`gnome-software-editor` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.30.6-3.el8	0:3.30.6-3.el8
`gnome-software-editor-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.30.6-3.el8	0:3.30.6-3.el8
`gnome-terminal` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.3-1.el8	0:3.28.3-1.el8
`gnome-terminal-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.3-1.el8	0:3.28.3-1.el8
`gnome-terminal-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.3-1.el8	0:3.28.3-1.el8
`gnome-terminal-nautilus` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.3-1.el8	0:3.28.3-1.el8
`gnome-terminal-nautilus-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.3-1.el8	0:3.28.3-1.el8
`gnome-tweaks` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-7.el8	0:3.28.1-7.el8
`gsettings-desktop-schemas` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.0-4.el8	0:3.32.0-4.el8
`gsettings-desktop-schemas-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.0-4.el8	0:3.32.0-4.el8
`gtk-update-icon-cache` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk-update-icon-cache-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk3` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk3-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk3-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk3-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk3-devel-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk3-immodule-xim` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk3-immodule-xim-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk3-immodules-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gtk3-tests-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.30-5.el8	0:3.22.30-5.el8
`gvfs` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-afc` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-afc-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-afp` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-afp-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-archive` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-archive-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-client` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-client-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-fuse` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-fuse-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-goa` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-goa-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-gphoto2` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-gphoto2-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-mtp` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-mtp-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-smb` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-smb-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`libvncserver` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.9.11-14.el8	0:0.9.11-14.el8
`libvncserver-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.9.11-14.el8	0:0.9.11-14.el8
`libvncserver-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:0.9.11-14.el8	0:0.9.11-14.el8
`libxslt-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.1.32-4.el8	0:1.1.32-4.el8
`libxslt-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.1.32-4.el8	0:1.1.32-4.el8
`libxslt-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:1.1.32-4.el8	0:1.1.32-4.el8
`mutter` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.2-34.el8	0:3.32.2-34.el8
`mutter-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.2-34.el8	0:3.32.2-34.el8
`mutter-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.2-34.el8	0:3.32.2-34.el8
`mutter-tests-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.32.2-34.el8	0:3.32.2-34.el8
`nautilus` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`nautilus-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`nautilus-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`nautilus-extensions` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`nautilus-extensions-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`vinagre` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.0-21.el8	0:3.22.0-21.el8
`vinagre-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.0-21.el8	0:3.22.0-21.el8
`vinagre-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:3.22.0-21.el8	0:3.22.0-21.el8
`gsettings-desktop-schemas` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:3.32.0-4.el8	0:3.32.0-4.el8
`libxslt` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:1.1.32-4.el8	0:1.1.32-4.el8
`libxslt-debuginfo` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:1.1.32-4.el8	0:1.1.32-4.el8
`libxslt-debugsource` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:1.1.32-4.el8	0:1.1.32-4.el8
`mozjs52` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:52.9.0-2.el8	0:52.9.0-2.el8
`mozjs52-debuginfo` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:52.9.0-2.el8	0:52.9.0-2.el8
`mozjs52-debugsource` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:52.9.0-2.el8	0:52.9.0-2.el8
`mozjs52-devel-debuginfo` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:52.9.0-2.el8	0:52.9.0-2.el8
`mozjs60` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:60.9.0-4.el8	0:60.9.0-4.el8
`mozjs60-debuginfo` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:60.9.0-4.el8	0:60.9.0-4.el8
`mozjs60-debugsource` Red Hat:enterprise_linux:8::baseos From an advisory covering 5 CVEs	before 0:60.9.0-4.el8	0:60.9.0-4.el8
`LibRaw` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.19.5-1.el8	0:0.19.5-1.el8
`LibRaw-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.19.5-1.el8	0:0.19.5-1.el8
`LibRaw-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.19.5-1.el8	0:0.19.5-1.el8
`LibRaw-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.19.5-1.el8	0:0.19.5-1.el8
`LibRaw-samples-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.19.5-1.el8	0:0.19.5-1.el8
`accountsservice-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.6.50-8.el8	0:0.6.50-8.el8
`accountsservice-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.6.50-8.el8	0:0.6.50-8.el8
`accountsservice-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.6.50-8.el8	0:0.6.50-8.el8
`accountsservice-libs-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.6.50-8.el8	0:0.6.50-8.el8
`clutter-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`clutter-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`clutter-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`clutter-doc` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`clutter-tests-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`gjs-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.56.2-4.el8	0:1.56.2-4.el8
`gjs-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.56.2-4.el8	0:1.56.2-4.el8
`gjs-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.56.2-4.el8	0:1.56.2-4.el8
`gjs-tests-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.56.2-4.el8	0:1.56.2-4.el8
`gnome-menus-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.13.3-11.el8	0:3.13.3-11.el8
`gnome-menus-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.13.3-11.el8	0:3.13.3-11.el8
`gnome-menus-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.13.3-11.el8	0:3.13.3-11.el8
`gvfs` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-afc-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-afp-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-archive-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-client-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-fuse-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-goa-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-gphoto2-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-mtp-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`gvfs-smb-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:1.36.2-8.el8	0:1.36.2-8.el8
`libvncserver` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.9.11-14.el8	0:0.9.11-14.el8
`libvncserver-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.9.11-14.el8	0:0.9.11-14.el8
`libvncserver-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.9.11-14.el8	0:0.9.11-14.el8
`libvncserver-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.9.11-14.el8	0:0.9.11-14.el8
`mozjs52-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:52.9.0-2.el8	0:52.9.0-2.el8
`mozjs52-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:52.9.0-2.el8	0:52.9.0-2.el8
`mozjs52-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:52.9.0-2.el8	0:52.9.0-2.el8
`mozjs52-devel-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:52.9.0-2.el8	0:52.9.0-2.el8
`mozjs60-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:60.9.0-4.el8	0:60.9.0-4.el8
`mozjs60-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:60.9.0-4.el8	0:60.9.0-4.el8
`mozjs60-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:60.9.0-4.el8	0:60.9.0-4.el8
`mutter-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.32.2-34.el8	0:3.32.2-34.el8
`mutter-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.32.2-34.el8	0:3.32.2-34.el8
`mutter-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.32.2-34.el8	0:3.32.2-34.el8
`mutter-tests-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.32.2-34.el8	0:3.32.2-34.el8
`nautilus` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`nautilus-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`nautilus-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`nautilus-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`nautilus-extensions-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:3.28.1-12.el8	0:3.28.1-12.el8
`vala` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.40.19-1.el8	0:0.40.19-1.el8
`vala-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.40.19-1.el8	0:0.40.19-1.el8
`vala-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.40.19-1.el8	0:0.40.19-1.el8
`vala-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.40.19-1.el8	0:0.40.19-1.el8
`valadoc-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 5 CVEs	before 0:0.40.19-1.el8	0:0.40.19-1.el8
`baobab` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:3.28.0-4.el8	0:3.28.0-4.el8
`clutter` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:1.26.2-8.el8	0:1.26.2-8.el8
`gnome-menus` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:3.13.3-11.el8	0:3.13.3-11.el8
`gnome-tweaks` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:3.28.1-7.el8	0:3.28.1-7.el8
`mozjs52` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:52.9.0-2.el8	0:52.9.0-2.el8
`mozjs60` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:60.9.0-4.el8	0:60.9.0-4.el8
`libraw` SUSE:Linux Enterprise Workstation Extension 15 From an advisory covering 7 CVEs	before 0.18.9-3.8.1	0.18.9-3.8.1
`darktable` Ubuntu:16.04:LTS	All versions, plus listed versions 1.6.8-11.6.9-12.0.0-12.0.1-12.0.3-1	None known
`dcraw` Ubuntu:16.04:LTS	All versions, plus listed versions 9.21-0.2	None known
`exactimage` Ubuntu:16.04:LTS	All versions, plus listed versions 0.9.1-6build10.9.1-6ubuntu10.9.1-8ubuntu10.9.1-90.9.1-9build1 Show 4 moreShow less 0.9.1-100.9.1-110.9.1-120.9.1-12ubuntu1	None known
`kodi` Ubuntu:16.04:LTS	All versions, plus listed versions 15.1+dfsg1-315.2+dfsg1-1build115.2+dfsg1-315.2+dfsg1-3ubuntu115.2+dfsg1-3ubuntu1.1	None known
`rawtherapee` Ubuntu:16.04:LTS	All versions, plus listed versions 4.2-2build14.2-4	None known
`ufraw` Ubuntu:16.04:LTS	All versions, plus listed versions 0.20-3build1	None known
`libraw` Ubuntu:18.04:LTS	before 0.18.8-1ubuntu0.3, plus listed versions 0.18.2-20.18.5-10.18.7-20.18.8-10.18.8-1ubuntu0.10.18.8-1ubuntu0.2	0.18.8-1ubuntu0.3
`darktable` Ubuntu:18.04:LTS	All versions, plus listed versions 2.2.5-22.4.0-12.4.1-12.4.2-1	None known
`dcraw` Ubuntu:18.04:LTS	All versions, plus listed versions 9.27-1ubuntu1	None known
`exactimage` Ubuntu:18.04:LTS	All versions, plus listed versions 0.9.2-1build11.0.1-1	None known
`kodi` Ubuntu:18.04:LTS	All versions, plus listed versions 2:17.3+dfsg1-32:17.3+dfsg1-3build12:17.3+dfsg1-52:17.3+dfsg1-5build12:17.3+dfsg1-5build22:17.6+dfsg1-12:17.6+dfsg1-1build12:17.6+dfsg1-1ubuntu1	None known
`rawtherapee` Ubuntu:18.04:LTS	All versions, plus listed versions 5.2-15.3-1	None known
`ufraw` Ubuntu:18.04:LTS	All versions, plus listed versions 0.22-1.10.22-20.22-30.22-3.1~build0.18.04.10.22-3.1ubuntu0.1	None known
`darktable` Ubuntu:20.04:LTS	All versions, plus listed versions 2.6.0-12.6.2-32.6.3-12.6.3-1build12.6.3-1build23.0.1-0ubuntu1	None known
`dcraw` Ubuntu:20.04:LTS	All versions, plus listed versions 9.28-2	None known
`exactimage` Ubuntu:20.04:LTS	All versions, plus listed versions 1.0.2-31.0.2-5ubuntu11.0.2-5ubuntu21.0.2-7ubuntu11.0.2-7ubuntu2	None known
`kodi` Ubuntu:20.04:LTS	All versions, plus listed versions 2:17.6+dfsg1-4ubuntu42:17.6+dfsg1-4ubuntu92:17.6+dfsg1-4ubuntu102:18.5+dfsg1-0ubuntu32:18.6+dfsg1-2ubuntu1	None known
`rawtherapee` Ubuntu:20.04:LTS	All versions, plus listed versions 5.6-15.7-15.8-1	None known
`darktable` Ubuntu:22.04:LTS	All versions, plus listed versions 3.6.0-0ubuntu13.8.0-23.8.0-33.8.0-3build13.8.0-3build23.8.1-13.8.1-2	None known
`dcraw` Ubuntu:22.04:LTS	All versions, plus listed versions 9.28-29.28-3	None known
`exactimage` Ubuntu:22.04:LTS	All versions, plus listed versions 1.0.2-81.0.2-8build11.0.2-8build21.0.2-8build3	None known
`kodi` Ubuntu:22.04:LTS	All versions, plus listed versions 2:19.1+dfsg2-22:19.3+dfsg1-12:19.3+dfsg1-1build22:19.3+dfsg1-1build32:19.3+dfsg1-1build42:19.3+dfsg1-1build52:19.4+dfsg1-2	None known
`rawtherapee` Ubuntu:22.04:LTS	All versions, plus listed versions 5.8-3	None known
`darktable` Ubuntu:24.04:LTS	All versions, plus listed versions 4.4.2-1ubuntu14.4.2-1ubuntu24.4.2-1.14.4.2-1.1build14.6.1-24.6.1-2build34.6.1-2build44.6.1-2ubuntu1	None known
`dcraw` Ubuntu:24.04:LTS	All versions, plus listed versions 9.28-39.28-3.1ubuntu19.28-5ubuntu1	None known
`exactimage` Ubuntu:24.04:LTS	All versions, plus listed versions 1.0.2-11build21.0.2-11build31.0.2-11build41.0.2-11build71.0.2-11build81.0.2-11build9	None known
`kodi` Ubuntu:24.04:LTS	All versions, plus listed versions 2:20.2+dfsg-42:20.2+dfsg-4build12:20.2+dfsg-4build22:20.2+dfsg-4ubuntu12:20.3+dfsg-12:20.4+dfsg-12:20.5+dfsg-1build22:20.5+dfsg-1ubuntu1	None known
`rawtherapee` Ubuntu:24.04:LTS	All versions, plus listed versions 5.9-1build15.9-25.10-15.10-1build35.10-1build4	None known
`darktable` Ubuntu:25.10	All versions, plus listed versions 5.0.1-0ubuntu15.0.1-0ubuntu25.0.1-15.0.1-2	None known
`dcraw` Ubuntu:25.10	All versions, plus listed versions 9.28-8	None known
`exactimage` Ubuntu:25.10	All versions, plus listed versions 1.2.1-2	None known
`kodi` Ubuntu:25.10	All versions, plus listed versions 2:21.2+dfsg-1build22:21.2+dfsg-42:21.2+dfsg-4build12:21.2+dfsg-4build2	None known
`rawtherapee` Ubuntu:25.10	All versions, plus listed versions 5.11-2build2	None known
`darktable` Ubuntu:26.10	All versions, plus listed versions 5.4.1-15.4.1-1build15.4.1-1build2	None known
`dcraw` Ubuntu:26.10	All versions, plus listed versions 9.28-8build1	None known
`exactimage` Ubuntu:26.10	All versions, plus listed versions 1.2.1-2build21.2.1-3build11.2.1-3build2	None known
`kodi` Ubuntu:26.10	All versions, plus listed versions 2:21.3+dfsg-1ubuntu12:21.3+dfsg-1.2	None known
`rawtherapee` Ubuntu:26.10	All versions, plus listed versions 5.12-25.12-2build1	None known
`darktable` Ubuntu:26.04:LTS	All versions, plus listed versions 5.0.1-25.2.1-15.2.1-1build15.2.1-1build25.4.0-15.4.1-1	None known
`dcraw` Ubuntu:26.04:LTS	All versions, plus listed versions 9.28-89.28-8build1	None known
`exactimage` Ubuntu:26.04:LTS	All versions, plus listed versions 1.2.1-21.2.1-2build11.2.1-2build2	None known
`kodi` Ubuntu:26.04:LTS	All versions, plus listed versions 2:21.2+dfsg-4build22:21.2+dfsg-4build32:21.2+dfsg-52:21.3+dfsg-12:21.3+dfsg-1build12:21.3+dfsg-1ubuntu1	None known
`rawtherapee` Ubuntu:26.04:LTS	All versions, plus listed versions 5.11-2build25.12-15.12-2	None known
`libraw` Ubuntu:16.04:LTS From an advisory covering 7 CVEs	before 0.17.1-1ubuntu0.5, plus listed versions 0.16.2-10.17.0-10.17.1-10.17.1-1ubuntu0.10.17.1-1ubuntu0.20.17.1-1ubuntu0.30.17.1-1ubuntu0.4	0.17.1-1ubuntu0.5
`libraw` Ubuntu:18.04:LTS From an advisory covering 7 CVEs	before 0.18.8-1ubuntu0.3, plus listed versions 0.18.2-20.18.5-10.18.7-20.18.8-10.18.8-1ubuntu0.10.18.8-1ubuntu0.2	0.18.8-1ubuntu0.3
`libraw` openSUSE:Leap 15.0 From an advisory covering 7 CVEs	before 0.18.9-lp150.2.6.1	0.18.9-lp150.2.6.1
`libraw` openSUSE:Tumbleweed From an advisory covering 13 CVEs	before 0.20.2-4.1	0.20.2-4.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-20337 is a high vulnerability (CVSS 8.8) in Libraw, published December 21, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. Fixed in libraw 0.19.2-1.

References

Show 193 moreShow less