Fluid Attacks Database

Description

Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	libkdcraw	>=0 <24.12.0-1	24.12.0-1
debian 14	libraw	>=0 <0.15.3-1	0.15.3-1
debian 11	darktable	>=0 <1.2.1-2	1.2.1-2
debian 14	darktable	>=0 <1.2.1-2	1.2.1-2
debian 11	libraw	>=0 <0.15.3-1	0.15.3-1
debian 12	darktable	>=0 <1.2.1-2	1.2.1-2
debian 12	libraw	>=0 <0.15.3-1	0.15.3-1
debian 13	darktable	>=0 <1.2.1-2	1.2.1-2
debian 13	libkdcraw	>=0 <24.12.0-1	24.12.0-1
debian 13	libraw	>=0 <0.15.3-1	0.15.3-1

Aliases

1. CVE-2013-21262. NVD-2013-21263. OSV-DEBIAN-2013-21264. OSV-2013-21265. SECURITY-TRACKER-CVE-2013-2126

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.