{"id":"CVE-2013-1438","aliases":["DEBIAN-CVE-2013-1438","DSA-2748-1","EUVD-2013-1476","GHSA-h3x3-43mf-g7c4","MGASA-2013-0301","MGASA-2013-0385","MGASA-2014-0011","MGASA-2014-0050","MGASA-2014-0071","MGASA-2014-0081","UBUNTU-CVE-2013-1438"],"status":"published","title":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and...","description":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02059,"percentile":0.81459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-08-30T00:00:00Z","modified":"2026-10-17T12:52:48Z","fixes":[{"ecosystem":"Debian:12","package":"darktable","fixed_in":["1.2.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"darktable","fixed_in":["1.2.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"darktable","fixed_in":["1.2.2-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dcraw","fixed_in":["9.28-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dcraw","fixed_in":["9.28-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dcraw","fixed_in":["9.28-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"exactimage","fixed_in":["0.8.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exactimage","fixed_in":["0.8.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exactimage","fixed_in":["0.8.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libkdcraw","fixed_in":["24.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libkdcraw","fixed_in":["24.12.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libraw","fixed_in":["0.15.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libraw","fixed_in":["0.15.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libraw","fixed_in":["0.15.4-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"exactimage","fixed_in":["0.8.1-3+deb6u2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"exactimage","fixed_in":["0.8.5-5+deb7u2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"dcraw","fixed_in":["9.19-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"ufraw","fixed_in":["0.19.2-5.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"xbmc","fixed_in":["12.3-1.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"xbmc","fixed_in":["12.3-1.1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"rawtherapee","fixed_in":["4.0.7-3.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"rawtherapee","fixed_in":["4.0.11-2.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libraw","fixed_in":["0.15.3-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ufraw","fixed_in":["0.19.2-2ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.28-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.28-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.28-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libkdcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libkdcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.12.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.4-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-3+deb6u2"}]}],"versions":["0.8.1-3"]},{"source":"osv","ecosystem":"Debian:7","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.5-5+deb7u2"}]}],"versions":["0.8.5-5"]},{"source":"osv","ecosystem":"Mageia:2","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.5-1.2.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.7-5.2.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"libkdcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.5-1.2.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.19-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"ufraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.2-5.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-1.2.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"xbmc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3-1.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"xbmc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3-1.1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7-3.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-2.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.3-1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ufraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.2-2ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.21-0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2-2build1","4.2-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.27-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-1","5.3-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6-1","5.7-1","5.8-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9-1build1","5.9-2","5.10-1","5.10-1build3","5.10-1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12-2","5.12-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11-2build2","5.12-1","5.12-2"]}],"products":[{"vendor":"dave_coffin","product":"dcraw"}],"references":[{"url":"http://www.debian.org/security/2013/dsa-2748","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/62060","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/08/29/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1438"},{"url":"https://github.com/advisories/GHSA-h3x3-43mf-g7c4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-1438","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0301.html","tags":["advisory"]},{"url":"http://www.ubuntu.com/usn/usn-1964-1/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11376","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2013-0385.html","tags":["advisory"]},{"url":"http://www.ubuntu.com/usn/usn-1978-1/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12074","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0011.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12125","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-December/124176.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-December/124183.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0050.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12692","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0071.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12613","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11149","tags":["report"]},{"url":"http://xbmc.org/xbmc-12-3-frodo-fixes/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0081.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12693","tags":["report"]},{"url":"http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1438.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-1438","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-1964-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-1978-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1438","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-1438","description":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.","status":"published","published":"2014-01-19T16:00:00Z","modified":"2024-08-06T15:04:48.383Z","updated_at":"2026-11-02T14:34:58.534075Z"}],"euvd":[{"id":"EUVD-2013-1476","description":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.","status":"published","published":"2014-01-19T16:00:00Z","modified":"2024-08-06T15:04:48Z","updated_at":"2026-11-03T01:56:42.411756Z"}],"ghsa":[{"id":"GHSA-h3x3-43mf-g7c4","title":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and...","description":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.","status":"published","published":"2022-05-17T03:46:32Z","modified":"2023-01-27T05:07:43Z","updated_at":"2026-11-02T14:43:10.83298Z"}],"nvd":[{"id":"CVE-2013-1438","description":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.","status":"published","published":"2014-01-19T18:02:56.6Z","modified":"2026-06-16T23:51:26.19Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"CVE-2013-1438","description":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.","status":"published","published":"2014-01-19T18:02:56Z","modified":"2026-04-16T06:25:33.291919004Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-1438","description":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.","status":"published","published":"2014-01-19T18:02:56.6Z","modified":"2026-09-01T20:03:12.899555752Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DSA-2748-1","title":"exactimage - denial of service","status":"published","published":"2013-09-01T00:00:00Z","modified":"2026-03-09T01:22:29.642673Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0301","title":"Updated libraw packages fix security vulnerabilities","description":"Updated libraw packages fix security vulnerabilities:\n\nIt was discovered that LibRaw incorrectly handled photo files. If a user or\nautomated system were tricked into processing a specially crafted photo\nfile, applications linked against LibRaw could be made to crash, resulting\nin a denial of service (CVE-2013-1438, CVE-2013-1439).\n","status":"published","published":"2013-10-09T22:39:51Z","modified":"2026-04-16T06:25:39.659628047Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2013-0385","title":"Updated libkdcraw packages fix CVE-2013-1438 \u0026 CVE-2013-1439","description":"Updated libkdcraw packages fix libraw security vulnerabilities:\n\nIt was discovered that LibRaw incorrectly handled photo files. If a user or\nautomated system were tricked into processing a specially crafted photo\nfile, applications linked against LibRaw could be made to crash, resulting\nin a denial of service (CVE-2013-1438, CVE-2013-1439).\n","status":"published","published":"2013-12-23T17:20:10Z","modified":"2026-04-16T06:22:35.491368106Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0011","title":"Updated dcraw and ufraw package fix security vulnerability","description":"Due to flaws in the embedded copy of LibRaw in dcraw and ufraw, corrupt\ninput files might trigger a division by zero, an infinite loop, or a null\npointer dereference (CVE-2013-1438).\n\nThe dcraw and ufraw packages have been updated to their newest versions\nand patched to fix the flaws in the embedded LibRaw library.  They have\nalso been patched to use the more secure lcms2 color management library,\nrather than the unmaintained lcms library.\n","status":"published","published":"2014-01-17T00:24:49Z","modified":"2026-04-16T06:24:51.835718964Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0050","title":"Updated darktable package fixes two vulnerabilities","description":"Updated darktable package fixes security vulnerabilities:\n\nDarktable before version 1.2.3 contains an embedded copy of LibRaw that\nincorrectly handled photo files. If a user was tricked into processing a\nspecially crafted photo file, darktable could be made to crash, resulting\nin a denial of service (CVE-2013-1438, CVE-2013-1439).\n","status":"published","published":"2014-02-10T20:21:49Z","modified":"2026-04-16T06:26:01.571067201Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0071","title":"Updated xbmc package fixes a security vulnerability","description":"Due to flaws in the embedded copy of libDCR, a fork of dcraw.c, in the\nembedded copy of CxImage, opening a specially crafted photo file could\ntrigger a division by zero, an infinite loop, or a null pointer\ndereference, resulting in a denial of service (CVE-2013-1438).\n\nThis update fixes those flaws.\n\nXBMC is also updated to a newer bugfix-only release, version 12.3.\nIt contains fixes to various issues, including:\n - several PVR related bugs\n - memory leaks\n - audio channel mapping\n - possible crash on progress dialog\nand more.\n\nAdditionally, this update fixes a compatibility issue on Mageia 4\naffecting AC-3 transcoding, which prevented, for example, multichannel\nplayback of AAC 5.1 files over S/PDIF or stereo-only HDMI devices.\n\nThe PVR addons have also been updated.\n","status":"published","published":"2014-02-16T12:54:48Z","modified":"2026-04-16T06:22:56.31074882Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0081","title":"Updated rawtherapee package fixes security vulnerability","description":"Due to flaws in the embedded copy of dcraw in rawtherapee, corrupt input\nfiles might trigger a division by zero, an infinite loop, or a null pointer\ndereference (CVE-2013-1438).\n","status":"published","published":"2014-02-17T00:25:25Z","modified":"2026-04-16T06:25:34.378352708Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-1438","description":"Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.","status":"published","published":"2013-08-30T00:00:00Z","modified":"2026-10-17T12:52:48.157367213Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}