CVE-2013-1439
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context...
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
Exploit likelihood
What each source reports
NVD Score used
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
- Record
CVE-2013-1439- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
- Record
CVE-2013-1439- Updated
- 2026-11-02
EUVDEUVD-2013-1477 No score
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
- Record
EUVD-2013-1477- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rcvp-8v7c-m59p No score
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context...
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
- Record
GHSA-rcvp-8v7c-m59p- Updated
- 2026-11-02
OSV No score
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
- Record
CVE-2013-1439- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1439 No score
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
- Record
DEBIAN-CVE-2013-1439- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2013-0301 No score
Updated libraw packages fix security vulnerabilities
Updated libraw packages fix security vulnerabilities:
It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, applications linked against LibRaw could be made to crash, resulting in a denial of service (CVE-2013-1438, CVE-2013-1439).
- Record
MGASA-2013-0301- Updated
- 2026-11-02
OSVMGASA-2013-0385 No score
Updated libkdcraw packages fix CVE-2013-1438 & CVE-2013-1439
Updated libkdcraw packages fix libraw security vulnerabilities:
It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, applications linked against LibRaw could be made to crash, resulting in a denial of service (CVE-2013-1438, CVE-2013-1439).
- Record
MGASA-2013-0385- Updated
- 2026-11-02
OSVMGASA-2014-0050 No score
Updated darktable package fixes two vulnerabilities
Updated darktable package fixes security vulnerabilities:
Darktable before version 1.2.3 contains an embedded copy of LibRaw that incorrectly handled photo files. If a user was tricked into processing a specially crafted photo file, darktable could be made to crash, resulting in a denial of service (CVE-2013-1438, CVE-2013-1439).
- Record
MGASA-2014-0050- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-1439 No score
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
- Record
UBUNTU-CVE-2013-1439- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
darktableDebian:12 |
before 1.2.2-2 | 1.2.2-2 |
darktableDebian:13 |
before 1.2.2-2 | 1.2.2-2 |
darktableDebian:14 |
before 1.2.2-2 | 1.2.2-2 |
libkdcrawDebian:13 |
before 24.12.0-1 | 24.12.0-1 |
libkdcrawDebian:14 |
before 24.12.0-1 | 24.12.0-1 |
librawDebian:12 |
before 0.15.4-1 | 0.15.4-1 |
librawDebian:13 |
before 0.15.4-1 | 0.15.4-1 |
librawDebian:14 |
before 0.15.4-1 | 0.15.4-1 |
librawMageia:2 From an advisory covering 2 CVEs |
before 0.14.5-1.2.mga2 | 0.14.5-1.2.mga2 |
librawMageia:3 From an advisory covering 2 CVEs |
before 0.14.7-5.2.mga3 | 0.14.7-5.2.mga3 |
libkdcrawMageia:3 From an advisory covering 2 CVEs |
before 4.10.5-1.2.mga3 | 4.10.5-1.2.mga3 |
darktableMageia:3 From an advisory covering 2 CVEs |
before 1.2-1.2.mga3 | 1.2-1.2.mga3 |
librawUbuntu:14.04:LTS |
before 0.15.3-1ubuntu1 | 0.15.3-1ubuntu1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1439 is a medium vulnerability (CVSS 4.3) in Libraw, published September 16, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.06%, the 81st percentile. Fixed in darktable 1.2.2-2.
References
debian.org/security/2013/dsa-2748
github.com/LibRaw/LibRaw/commit/11909cc59e712e09b508dda729b99aeaac2b29ad
openwall.com/lists/oss-security/2013/08/29/3
nvd.nist.gov/vuln/detail/CVE-2013-1439
security-tracker.debian.org/tracker/CVE-2013-1439
Show 12 moreShow less
advisories.mageia.org/MGASA-2013-0301.html
ubuntu.com/usn/usn-1964-1
bugs.mageia.org/show_bug.cgi?id=11376
ubuntu.com/security/CVE-2013-1439
cve.org/CVERecord?id=CVE-2013-1439