CVE-2020-15503: debian debian_linux Improper Input Validation
CVSS: 7.5v3.1HighModified
AliasesMGASA-2020-0368SUSE-SU-2020:2028-1SUSE-SU-2020:2029-1UBUNTU-CVE-2020-15503DEBIAN-CVE-2020-15503DLA-3214-1openSUSE-SU-2020:1088-1openSUSE-SU-2020:1128-1
Published 02-07-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-15503 is a high (CVSS 7.5) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 3.67% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
3.67%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 02-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
LibRaw before 0.20-RC1 lacks a thumbnail size range check. This affects decoders/unpack_thumb.cpp, postprocessing/mem_image.cpp, and utils/thumb_utils.cpp. For example, malloc(sizeof(libraw_processed_image_t)+T.tlength) occurs without validating T.tlength.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
3.67%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.67% on 19-09-2026
19-09-202619-10-2026
EPSS score3.67%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu7 products
- darktableAll versions (No fix recorded)
- dcrawAll versions (No fix recorded)
- exactimageAll versions (No fix recorded)
- kodiAll versions (No fix recorded)
- librawAll versions (No fix recorded) | < 0.18.8-1ubuntu0.4 | < 0.19.5-1ubuntu1.1
Suse4 products
- libraw&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 0.15.4-33.1
- libraw&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 0.15.4-33.1
- libraw&distro=SUSE Linux Enterprise Workstation Extension 15 SP1< 0.18.9-3.11.1
- libraw&distro=SUSE Linux Enterprise Workstation Extension 15 SP2< 0.18.9-3.11.1
Debian2 products
- libraw< 0.20.0-4 | < 0.19.2-2+deb10u2
- debian_linuxEOL10.0
Opensuse2 products
- libraw&distro=openSUSE Leap 15.1< 0.18.9-lp151.4.3.1
- libraw&distro=openSUSE Leap 15.2< 0.18.9-lp152.5.3.1
Fedoraproject1 product
- fedoraEOL31 | 32
Libraw1 product
- libraw≤ 0.19.5 | 0.20:beta1 | 0.20:beta2 | 0.20:beta3
Mageia1 product
- libraw< 0.19.2-1.1.mga7
7 vendors · 18 products
References
28 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00075.htmlVendor AdvisoryBroken LinkMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00001.htmlVendor AdvisoryBroken LinkMailing ListThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 28 references
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
