Log in Start free

Vulnerability · Published May 15, 2023 · Assigned by redhat

CVE-2023-1729

Medium 6.5

In plain English

A medium-severity memory corruption in LibRaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.3%top 29.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9LibRaw0.21.1-1.el9ALSA-2024:2137
AlmaLinux:9LibRaw-devel0.21.1-1.el9ALSA-2024:2137
Alpine:v3.20libraw0.21.1-r2ALPINE-CVE-2023-1729
Alpine:v3.21libraw0.21.1-r2ALPINE-CVE-2023-1729
Alpine:v3.22libraw0.21.1-r2ALPINE-CVE-2023-1729
Alpine:v3.23libraw0.21.1-r2ALPINE-CVE-2023-1729
Alpine:v3.24libraw0.21.1-r2ALPINE-CVE-2023-1729
Debian:12libraw0.20.2-2.1DEBIAN-CVE-2023-1729
Debian:13libraw0.20.2-2.1DEBIAN-CVE-2023-1729
Debian:14libraw0.20.2-2.1DEBIAN-CVE-2023-1729
Rocky Linux:9LibRaw0:0.21.1-1.el9RLSA-2024:2137
Ubuntu:22.04:LTSdarktableno fix listedUBUNTU-CVE-2023-1729
Ubuntu:24.04:LTSdarktableno fix listedUBUNTU-CVE-2023-1729
Ubuntu:25.10darktableno fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.04:LTSdarktableno fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.10darktableno fix listedUBUNTU-CVE-2023-1729
Ubuntu:22.04:LTSdcrawno fix listedUBUNTU-CVE-2023-1729
Ubuntu:24.04:LTSdcrawno fix listedUBUNTU-CVE-2023-1729
Ubuntu:25.10dcrawno fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.04:LTSdcrawno fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.10dcrawno fix listedUBUNTU-CVE-2023-1729
Ubuntu:22.04:LTSexactimageno fix listedUBUNTU-CVE-2023-1729
Ubuntu:24.04:LTSexactimageno fix listedUBUNTU-CVE-2023-1729
Ubuntu:25.10exactimageno fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.04:LTSexactimageno fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.10exactimageno fix listedUBUNTU-CVE-2023-1729
Ubuntu:22.04:LTSkodino fix listedUBUNTU-CVE-2023-1729
Ubuntu:24.04:LTSkodino fix listedUBUNTU-CVE-2023-1729
Ubuntu:25.10kodino fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.04:LTSkodino fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.10kodino fix listedUBUNTU-CVE-2023-1729
Ubuntu:22.04:LTSlibraw0.20.2-2ubuntu2.22.04.1USN-6137-1
Ubuntu:22.04:LTSlibraw0.20.2-2ubuntu2.22.04.1UBUNTU-CVE-2023-1729
Ubuntu:22.04:LTSrawtherapeeno fix listedUBUNTU-CVE-2023-1729
Ubuntu:24.04:LTSrawtherapeeno fix listedUBUNTU-CVE-2023-1729
Ubuntu:25.10rawtherapeeno fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.04:LTSrawtherapeeno fix listedUBUNTU-CVE-2023-1729
Ubuntu:26.10rawtherapeeno fix listedUBUNTU-CVE-2023-1729

Affected products (as reported)

VendorProductVersions
n/a LibRaw LibRaw 0.21.1

Weakness: CWE-119

References