{"id":"CVE-2020-22628","aliases":["DEBIAN-CVE-2020-22628","DLA-3560-1","EUVD-2020-15388","GHSA-c4mp-wp8f-qrg6","SUSE-SU-2023:3966-1","SUSE-SU-2023:3967-1","SUSE-SU-2023:3968-1","UBUNTU-CVE-2020-22628","USN-6377-1","USN-7266-1","openSUSE-SU-2024:13252-1"],"status":"published","title":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing...","description":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00772,"percentile":0.55989,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-125"],"published":"2023-08-22T00:00:00Z","modified":"2026-10-26T12:02:39Z","fixes":[{"ecosystem":"Debian:12","package":"libraw","fixed_in":["0.20.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libraw","fixed_in":["0.20.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libraw","fixed_in":["0.20.0-4"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libraw","fixed_in":["0.19.2-2+deb10u4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"libraw","fixed_in":["0.18.9-150000.3.23.1","0.20.2-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"libraw","fixed_in":["0.18.9-150000.3.23.1","0.20.2-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"libraw","fixed_in":["0.18.9-150000.3.23.1","0.20.2-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libraw","fixed_in":["0.15.4-42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"libraw","fixed_in":["0.15.4-42.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"libraw","fixed_in":["0.20.2-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"libraw","fixed_in":["0.20.2-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"libraw","fixed_in":["0.20.2-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libraw","fixed_in":["0.20.2-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libraw","fixed_in":["0.19.5-1ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"digikam","fixed_in":["4:6.4.0+dfsg-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libraw","fixed_in":["0.21.1-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-4"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.2-2+deb10u4"}]}],"versions":["0.19.2-2","0.19.2-2+deb10u1","0.19.2-2+deb10u2","0.19.2-2+deb10u3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.9-150000.3.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.9-150000.3.23.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.9-150000.3.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.4-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.4-42.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.2-1","0.17.0-1","0.17.1-1","0.17.1-1ubuntu0.1","0.17.1-1ubuntu0.2","0.17.1-1ubuntu0.3","0.17.1-1ubuntu0.4","0.17.1-1ubuntu0.5","0.17.1-1ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.8-1","1.6.9-1","2.0.0-1","2.0.1-1","2.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.21-0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-6build1","0.9.1-6ubuntu1","0.9.1-8ubuntu1","0.9.1-9","0.9.1-9build1","0.9.1-10","0.9.1-11","0.9.1-12","0.9.1-12ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.1+dfsg1-3","15.2+dfsg1-1build1","15.2+dfsg1-3","15.2+dfsg1-3ubuntu1","15.2+dfsg1-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2-2build1","4.2-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ufraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.2-2","0.18.5-1","0.18.7-2","0.18.8-1","0.18.8-1ubuntu0.1","0.18.8-1ubuntu0.2","0.18.8-1ubuntu0.3","0.18.8-1ubuntu0.4","0.18.8-1ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.5-2","2.4.0-1","2.4.1-1","2.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.27-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1build1","1.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:17.3+dfsg1-3","2:17.3+dfsg1-3build1","2:17.3+dfsg1-5","2:17.3+dfsg1-5build1","2:17.3+dfsg1-5build2","2:17.6+dfsg1-1","2:17.6+dfsg1-1build1","2:17.6+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-1","5.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ufraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22-1.1","0.22-2","0.22-3","0.22-3.1~build0.18.04.1","0.22-3.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.5-1ubuntu1.3"}]}],"versions":["0.19.5-1","0.19.5-1ubuntu1","0.19.5-1ubuntu1.1","0.19.5-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-1","2.6.2-3","2.6.3-1","2.6.3-1build1","2.6.3-1build2","3.0.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:6.4.0+dfsg-3ubuntu0.1~esm1"}]}],"versions":["4:5.9.0-1ubuntu4","4:6.4.0+dfsg-3","4:6.4.0+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-3","1.0.2-5ubuntu1","1.0.2-5ubuntu2","1.0.2-7ubuntu1","1.0.2-7ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:17.6+dfsg1-4ubuntu4","2:17.6+dfsg1-4ubuntu9","2:17.6+dfsg1-4ubuntu10","2:18.5+dfsg1-0ubuntu3","2:18.6+dfsg1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6-1","5.7-1","5.8-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.0-0ubuntu1","3.8.0-2","3.8.0-3","3.8.0-3build1","3.8.0-3build2","3.8.1-1","3.8.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-2","9.28-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-8","1.0.2-8build1","1.0.2-8build2","1.0.2-8build3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:19.1+dfsg2-2","2:19.3+dfsg1-1","2:19.3+dfsg1-1build2","2:19.3+dfsg1-1build3","2:19.3+dfsg1-1build4","2:19.3+dfsg1-1build5","2:19.4+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.2-1ubuntu1","4.4.2-1ubuntu2","4.4.2-1.1","4.4.2-1.1build1","4.6.1-2","4.6.1-2build3","4.6.1-2build4","4.6.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-3","9.28-3.1ubuntu1","9.28-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-11build2","1.0.2-11build3","1.0.2-11build4","1.0.2-11build7","1.0.2-11build8","1.0.2-11build9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:20.2+dfsg-4","2:20.2+dfsg-4build1","2:20.2+dfsg-4build2","2:20.2+dfsg-4ubuntu1","2:20.3+dfsg-1","2:20.4+dfsg-1","2:20.5+dfsg-1build2","2:20.5+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9-1build1","5.9-2","5.10-1","5.10-1build3","5.10-1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1-0ubuntu1","5.0.1-0ubuntu2","5.0.1-1","5.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.2+dfsg-1build2","2:21.2+dfsg-4","2:21.2+dfsg-4build1","2:21.2+dfsg-4build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.1-1","5.4.1-1build1","5.4.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-8build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2build2","1.2.1-3build1","1.2.1-3build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.3+dfsg-1ubuntu1","2:21.3+dfsg-1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12-2","5.12-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1-2","5.2.1-1","5.2.1-1build1","5.2.1-1build2","5.4.0-1","5.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-8","9.28-8build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2","1.2.1-2build1","1.2.1-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.2+dfsg-4build2","2:21.2+dfsg-4build3","2:21.2+dfsg-5","2:21.3+dfsg-1","2:21.3+dfsg-1build1","2:21.3+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11-2build2","5.12-1","5.12-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.5-1ubuntu1.3"}]}],"versions":["0.19.5-1","0.19.5-1ubuntu1","0.19.5-1ubuntu1.1","0.19.5-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.12.0-0ubuntu7+esm1"}]}],"versions":["4:4.12.0-0ubuntu5","4:4.12.0-0ubuntu6","4:4.12.0-0ubuntu7"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.6.0-0ubuntu10+esm1"}]}],"versions":["4:5.6.0-0ubuntu2","4:5.6.0-0ubuntu3","4:5.6.0-0ubuntu4","4:5.6.0-0ubuntu7","4:5.6.0-0ubuntu8","4:5.6.0-0ubuntu9","4:5.6.0-0ubuntu10"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:6.4.0+dfsg-3ubuntu0.1~esm1"}]}],"versions":["4:5.9.0-1ubuntu4","4:6.4.0+dfsg-3","4:6.4.0+dfsg-3build1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:7.5.0-3ubuntu0.1~esm1"}]}],"versions":["4:7.1.0-2","4:7.1.0-2ubuntu1","4:7.4.0-0ubuntu1","4:7.5.0-0ubuntu1","4:7.5.0-3fakesync1"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.1-3.1"}]}]}],"products":[{"vendor":"libraw","product":"libraw"}],"references":[{"url":"https://github.com/LibRaw/LibRaw/issues/269","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00007.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-22628"},{"url":"https://github.com/advisories/GHSA-c4mp-wp8f-qrg6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-22628","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233966-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215308","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-22628","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233967-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233968-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-22628","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6377-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-22628","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7266-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-0691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-19858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-1729","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-22628","description":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2024-10-03T18:04:08.106Z","updated_at":"2026-11-02T14:35:46.873079Z"}],"euvd":[{"id":"EUVD-2020-15388","description":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2024-10-03T18:04:08Z","updated_at":"2026-11-03T00:27:54.233481Z"}],"ghsa":[{"id":"GHSA-c4mp-wp8f-qrg6","title":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing...","description":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp.","status":"published","published":"2023-08-22T21:30:25Z","modified":"2024-07-10T15:30:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-120","CWE-125"],"updated_at":"2026-11-02T14:57:40.937292Z"}],"nvd":[{"id":"CVE-2020-22628","description":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp.","status":"published","published":"2023-08-22T19:16:19.353Z","modified":"2026-06-17T03:04:18.31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:06:47.910346Z"}],"osv":[{"id":"CVE-2020-22628","description":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp.","status":"published","published":"2023-08-22T19:16:19.353Z","modified":"2026-10-20T10:52:14.59938799Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:15.534837Z"},{"id":"DEBIAN-CVE-2020-22628","description":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp.","status":"published","published":"2023-08-22T19:16:19.353Z","modified":"2026-10-26T12:02:39.486329309Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"UBUNTU-CVE-2020-22628","description":"Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp.","status":"published","published":"2023-08-22T19:16:00Z","modified":"2026-10-17T12:55:51.945951105Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DLA-3560-1","title":"libraw - security update","status":"published","published":"2023-09-10T00:00:00Z","modified":"2026-03-09T01:19:02.555561Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"openSUSE-SU-2024:13252-1","title":"libraw-devel-0.21.1-3.1 on GA media","description":"These are all security issues fixed in the libraw-devel-0.21.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:11:49.983287Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3966-1","title":"Security update for libraw","description":"This update for libraw fixes the following issues:\n\n - CVE-2020-22628: Fixed buffer overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp. (bsc#1215308)\n","status":"published","published":"2023-10-04T10:30:30Z","modified":"2026-02-04T04:37:47.158744Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3967-1","title":"Security update for libraw","description":"This update for libraw fixes the following issues:\n\n - CVE-2020-22628: Fixed buffer overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp. (bsc#1215308)\n","status":"published","published":"2023-10-04T10:30:53Z","modified":"2026-02-04T03:16:20.147482Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3968-1","title":"Security update for libraw","description":"This update for libraw fixes the following issues:\n\n - CVE-2020-22628: Fixed buffer overflow vulnerability in LibRaw::stretch() function in libraw\\src\\postprocessing\\aspect_ratio.cpp. (bsc#1215308)\n","status":"published","published":"2023-10-04T10:31:51Z","modified":"2026-02-04T03:57:33.080993Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6377-1","title":"libraw vulnerability","description":"It was discovered that LibRaw incorrectly handled certain photo files. If a\nuser o automated system were tricked into processing a specially crafted\nphoto file, a remote attacker could possibly cause applications linked\nagainst LibRaw to crash, resulting in a denial of service.\n","status":"published","published":"2023-09-18T13:15:50Z","modified":"2026-04-27T16:51:45.068558Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-7266-1","title":"digikam vulnerabilities","description":"Zinuo Han and Ao Wang discovered that the Android DNG SDK, vendored in\ndigiKam, did not correctly parse certain files. An attacker could possibly\nuse this issue to execute arbitrary code. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2017-0691)\n\nIt was discovered that Platinum Upnp SDK, vendored in digiKam, was\nvulnerable to a path traversal attack. An attacker could possibly use this\nissue to leak sensitive information. This issue only affected \nUbuntu 20.04 LTS. (CVE-2020-19858)\n\nIt was discovered that LibRaw, vendored in digiKam, did not correctly\nhandle certain memory operations. If a user or automated system were\ntricked into opening a specially crafted file, an attacker could possibly\nuse this issue to leak sensitive information. This issue only affected\nUbuntu 20.04 LTS. (CVE-2020-22628)\n\nIt was discovered that LibRaw, vendored in digiKam, did not correctly\nhandle certain memory operations. If a user or automated system were\ntricked into opening a specially crafted file, an attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-35530,\nCVE-2020-35531, CVE-2020-35532, CVE-2020-35533)\n\nIt was discovered that LibRaw, vendored in digiKam, did not correctly\nhandle certain memory operations. If a user or automated system were\ntricked into opening a specially crafted file, an attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code.\nThis issue only affected Ubuntu 20.04 LTS. (CVE-2021-32142)\n\nIt was discovered that LibRaw, vendored in digiKam, did not correctly\nhandle certain memory operations. If a user or automated system were\ntricked into opening a specially crafted file, an attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code.\nThis issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2023-1729)\n","status":"published","published":"2025-02-13T03:28:13Z","modified":"2026-06-25T13:32:30.14328564Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}