LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpackthumb.cpp, postprocessing/memimage.cpp, and utils/thumbutils.cpp. For example, malloc(sizeof(librawprocessedimaget)+T.tlength) occurs without validating T.tlength.
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "libraw-bin-dbgsym": "0.18.8-1ubuntu0.4", "libraw-bin": "0.18.8-1ubuntu0.4", "libraw16-dbgsym": "0.18.8-1ubuntu0.4", "libraw-dev": "0.18.8-1ubuntu0.4", "libraw-doc": "0.18.8-1ubuntu0.4", "libraw16": "0.18.8-1ubuntu0.4" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "libraw-bin-dbgsym": "0.19.5-1ubuntu1.1", "libraw-bin": "0.19.5-1ubuntu1.1", "libraw-dev": "0.19.5-1ubuntu1.1", "libraw19-dbgsym": "0.19.5-1ubuntu1.1", "libraw-doc": "0.19.5-1ubuntu1.1", "libraw19": "0.19.5-1ubuntu1.1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "libraw-bin-dbgsym": "0.20.2-2ubuntu2", "libraw-bin": "0.20.2-2ubuntu2", "libraw20": "0.20.2-2ubuntu2", "libraw-dev": "0.20.2-2ubuntu2", "libraw-doc": "0.20.2-2ubuntu2", "libraw20-dbgsym": "0.20.2-2ubuntu2" } ] }