{"id":"CVE-2020-35530","aliases":["ALPINE-CVE-2020-35530","DEBIAN-CVE-2020-35530","DLA-3113-1","EUVD-2020-23197","GHSA-gf6q-7pjq-pfq7","JLSEC-2026-1102","UBUNTU-CVE-2020-35530","USN-5715-1","USN-7266-1"],"status":"published","title":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw...","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00393,"percentile":0.33775,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-09-01T17:52:13Z","modified":"2026-11-03T06:32:25Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"libraw","fixed_in":["0.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libraw","fixed_in":["0.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libraw","fixed_in":["0.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libraw","fixed_in":["0.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libraw","fixed_in":["0.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libraw","fixed_in":["0.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libraw","fixed_in":["0.20.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libraw","fixed_in":["0.20.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libraw","fixed_in":["0.20.0-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libraw","fixed_in":["0.20.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libraw","fixed_in":["0.20.0-4"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibRaw_jll","fixed_in":["0.22.1+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libraw","fixed_in":["0.18.8-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"digikam","fixed_in":["4:5.6.0-0ubuntu10+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libraw","fixed_in":["0.19.5-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"digikam","fixed_in":["4:6.4.0+dfsg-3ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-4"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.2-2+deb10u1"}]}],"versions":["0.19.2-2"],"bundled":4},{"source":"osv","ecosystem":"Julia","package":"LibRaw_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.22.1+0"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.2-1","0.17.0-1","0.17.1-1","0.17.1-1ubuntu0.1","0.17.1-1ubuntu0.2","0.17.1-1ubuntu0.3","0.17.1-1ubuntu0.4","0.17.1-1ubuntu0.5","0.17.1-1ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.8-1","1.6.9-1","2.0.0-1","2.0.1-1","2.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.21-0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-6build1","0.9.1-6ubuntu1","0.9.1-8ubuntu1","0.9.1-9","0.9.1-9build1","0.9.1-10","0.9.1-11","0.9.1-12","0.9.1-12ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.1+dfsg1-3","15.2+dfsg1-1build1","15.2+dfsg1-3","15.2+dfsg1-3ubuntu1","15.2+dfsg1-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2-2build1","4.2-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ufraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-3build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.8-1ubuntu0.4"}]}],"versions":["0.18.2-2","0.18.5-1","0.18.7-2","0.18.8-1","0.18.8-1ubuntu0.1","0.18.8-1ubuntu0.2","0.18.8-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.5-2","2.4.0-1","2.4.1-1","2.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.27-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.6.0-0ubuntu10+esm1"}]}],"versions":["4:5.6.0-0ubuntu2","4:5.6.0-0ubuntu3","4:5.6.0-0ubuntu4","4:5.6.0-0ubuntu7","4:5.6.0-0ubuntu8","4:5.6.0-0ubuntu9","4:5.6.0-0ubuntu10"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1build1","1.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:17.3+dfsg1-3","2:17.3+dfsg1-3build1","2:17.3+dfsg1-5","2:17.3+dfsg1-5build1","2:17.3+dfsg1-5build2","2:17.6+dfsg1-1","2:17.6+dfsg1-1build1","2:17.6+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-1","5.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ufraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22-1.1","0.22-2","0.22-3","0.22-3.1~build0.18.04.1","0.22-3.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.5-1ubuntu1.1"}]}],"versions":["0.19.5-1","0.19.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-1","2.6.2-3","2.6.3-1","2.6.3-1build1","2.6.3-1build2","3.0.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:6.4.0+dfsg-3ubuntu0.1~esm1"}]}],"versions":["4:5.9.0-1ubuntu4","4:6.4.0+dfsg-3","4:6.4.0+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-3","1.0.2-5ubuntu1","1.0.2-5ubuntu2","1.0.2-7ubuntu1","1.0.2-7ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:17.6+dfsg1-4ubuntu4","2:17.6+dfsg1-4ubuntu9","2:17.6+dfsg1-4ubuntu10","2:18.5+dfsg1-0ubuntu3","2:18.6+dfsg1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6-1","5.7-1","5.8-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.0-0ubuntu1","3.8.0-2","3.8.0-3","3.8.0-3build1","3.8.0-3build2","3.8.1-1","3.8.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-2","9.28-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-8","1.0.2-8build1","1.0.2-8build2","1.0.2-8build3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:19.1+dfsg2-2","2:19.3+dfsg1-1","2:19.3+dfsg1-1build2","2:19.3+dfsg1-1build3","2:19.3+dfsg1-1build4","2:19.3+dfsg1-1build5","2:19.4+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.2-1ubuntu1","4.4.2-1ubuntu2","4.4.2-1.1","4.4.2-1.1build1","4.6.1-2","4.6.1-2build3","4.6.1-2build4","4.6.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-3","9.28-3.1ubuntu1","9.28-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-11build2","1.0.2-11build3","1.0.2-11build4","1.0.2-11build7","1.0.2-11build8","1.0.2-11build9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:20.2+dfsg-4","2:20.2+dfsg-4build1","2:20.2+dfsg-4build2","2:20.2+dfsg-4ubuntu1","2:20.3+dfsg-1","2:20.4+dfsg-1","2:20.5+dfsg-1build2","2:20.5+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9-1build1","5.9-2","5.10-1","5.10-1build3","5.10-1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1-0ubuntu1","5.0.1-0ubuntu2","5.0.1-1","5.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.2+dfsg-1build2","2:21.2+dfsg-4","2:21.2+dfsg-4build1","2:21.2+dfsg-4build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.1-1","5.4.1-1build1","5.4.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-8build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2build2","1.2.1-3build1","1.2.1-3build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.3+dfsg-1ubuntu1","2:21.3+dfsg-1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12-2","5.12-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"darktable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1-2","5.2.1-1","5.2.1-1build1","5.2.1-1build2","5.4.0-1","5.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dcraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.28-8","9.28-8build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"exactimage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2","1.2.1-2build1","1.2.1-2build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kodi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.2+dfsg-4build2","2:21.2+dfsg-4build3","2:21.2+dfsg-5","2:21.3+dfsg-1","2:21.3+dfsg-1build1","2:21.3+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rawtherapee","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11-2build2","5.12-1","5.12-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.8-1ubuntu0.4"}]}],"versions":["0.18.2-2","0.18.5-1","0.18.7-2","0.18.8-1","0.18.8-1ubuntu0.1","0.18.8-1ubuntu0.2","0.18.8-1ubuntu0.3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libraw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.5-1ubuntu1.1"}]}],"versions":["0.19.5-1","0.19.5-1ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.12.0-0ubuntu7+esm1"}]}],"versions":["4:4.12.0-0ubuntu5","4:4.12.0-0ubuntu6","4:4.12.0-0ubuntu7"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.6.0-0ubuntu10+esm1"}]}],"versions":["4:5.6.0-0ubuntu2","4:5.6.0-0ubuntu3","4:5.6.0-0ubuntu4","4:5.6.0-0ubuntu7","4:5.6.0-0ubuntu8","4:5.6.0-0ubuntu9","4:5.6.0-0ubuntu10"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:6.4.0+dfsg-3ubuntu0.1~esm1"}]}],"versions":["4:5.9.0-1ubuntu4","4:6.4.0+dfsg-3","4:6.4.0+dfsg-3build1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:7.5.0-3ubuntu0.1~esm1"}]}],"versions":["4:7.1.0-2","4:7.1.0-2ubuntu1","4:7.4.0-0ubuntu1","4:7.5.0-0ubuntu1","4:7.5.0-3fakesync1"],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libraw","product":"libraw"}],"references":[{"url":"https://github.com/LibRaw/LibRaw/issues/272","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/LibRaw/LibRaw/commit/11c4db253ef2c9bb44247b578f5caa57c66a1eeb","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35530"},{"url":"https://github.com/advisories/GHSA-gf6q-7pjq-pfq7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-35530","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35530","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-35530","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-35530","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5715-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35530","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7266-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-15503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-0691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-19858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-22628","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-1729","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-35530","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.","status":"published","published":"2022-09-01T17:52:13Z","modified":"2024-08-04T17:02:08.174Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2020-23197","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.","status":"published","published":"2022-09-01T17:52:13Z","modified":"2024-08-04T17:02:08Z","updated_at":"2026-11-03T03:07:06.389211Z"}],"ghsa":[{"id":"GHSA-gf6q-7pjq-pfq7","title":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw...","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.","status":"published","published":"2022-09-02T00:01:08Z","modified":"2023-01-27T05:02:23Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:42:03.063922Z"}],"nvd":[{"id":"CVE-2020-35530","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.","status":"published","published":"2022-09-01T18:15:08.77Z","modified":"2026-06-17T03:13:52.36Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:47.286386Z"}],"osv":[{"id":"ALPINE-CVE-2020-35530","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.","status":"published","published":"2022-09-01T18:15:08.77Z","modified":"2026-11-03T06:32:25.789354881Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-35530","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.","status":"published","published":"2022-09-01T18:15:08.77Z","modified":"2026-10-20T14:00:22.749604679Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-35530","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.","status":"published","published":"2022-09-01T18:15:08.77Z","modified":"2026-10-26T12:02:43.45756856Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"JLSEC-2026-1102","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"`new_node()`\" function (`libraw\\src\\x3f\\x3f_utils_patched.cpp`) that can be triggered via a crafted X3F file.","status":"published","published":"2026-08-03T14:05:55.614Z","modified":"2026-08-03T14:15:03.341981637Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"UBUNTU-CVE-2020-35530","description":"In LibRaw, there is an out-of-bounds write vulnerability within the \"new_node()\" function (libraw\\src\\x3f\\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file.","status":"published","published":"2022-09-01T18:15:00Z","modified":"2026-10-17T12:56:55.550914562Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"DLA-3113-1","title":"libraw - security update","status":"published","published":"2022-09-16T00:00:00Z","modified":"2026-03-09T01:20:26.218676Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"USN-5715-1","title":"libraw vulnerabilities","description":"It was discovered that LibRaw incorrectly handled photo files. If a user or\nautomated system were tricked into processing a specially crafted photo\nfile, a remote attacker could cause applications linked against LibRaw to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2022-11-07T16:57:39Z","modified":"2026-04-27T16:24:53.857784Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-7266-1","title":"digikam vulnerabilities","description":"Zinuo Han and Ao Wang discovered that the Android DNG SDK, vendored in\ndigiKam, did not correctly parse certain files. An attacker could possibly\nuse this issue to execute arbitrary code. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2017-0691)\n\nIt was discovered that Platinum Upnp SDK, vendored in digiKam, was\nvulnerable to a path traversal attack. An attacker could possibly use this\nissue to leak sensitive information. This issue only affected \nUbuntu 20.04 LTS. (CVE-2020-19858)\n\nIt was discovered that LibRaw, vendored in digiKam, did not correctly\nhandle certain memory operations. If a user or automated system were\ntricked into opening a specially crafted file, an attacker could possibly\nuse this issue to leak sensitive information. This issue only affected\nUbuntu 20.04 LTS. (CVE-2020-22628)\n\nIt was discovered that LibRaw, vendored in digiKam, did not correctly\nhandle certain memory operations. If a user or automated system were\ntricked into opening a specially crafted file, an attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-35530,\nCVE-2020-35531, CVE-2020-35532, CVE-2020-35533)\n\nIt was discovered that LibRaw, vendored in digiKam, did not correctly\nhandle certain memory operations. If a user or automated system were\ntricked into opening a specially crafted file, an attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code.\nThis issue only affected Ubuntu 20.04 LTS. (CVE-2021-32142)\n\nIt was discovered that LibRaw, vendored in digiKam, did not correctly\nhandle certain memory operations. If a user or automated system were\ntricked into opening a specially crafted file, an attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code.\nThis issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2023-1729)\n","status":"published","published":"2025-02-13T03:28:13Z","modified":"2026-06-25T13:32:30.14328564Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}