CVE-2023-1729: fedoraproject fedora
CVSS: 6.5v3.1MediumAnalyzed
AliasesSUSE-SU-2023:2194-1SUSE-SU-2023:2195-1SUSE-SU-2023:2196-1RHSA-2024:2137UBUNTU-CVE-2023-1729DEBIAN-CVE-2023-1729openSUSE-SU-2024:12901-1
Published 15-05-2023Last modified 02-08-2024
Vulnerability summary
CVE-2023-1729 is a medium (CVSS 6.5) vulnerability in fedoraproject fedora. EPSS estimates a 1.29% chance of exploitation in the next 30 days, higher than 69.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
1.29%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 15-05-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSources4 sources · 3.3–6.5
- OSV · Red hatEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.29%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
0.00 pp
From 1.29% on 19-09-2026
19-09-202619-10-2026
EPSS score1.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLibraw
Maturity: poc
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Ubuntu8 products
- darktableAll versions (No fix recorded)
- dcrawAll versions (No fix recorded)
- digikam< 4:5.6.0-0ubuntu10+esm1 | < 4:6.4.0+dfsg-3ubuntu0.1~esm1 | < 4:7.5.0-3ubuntu0.1~esm1
- exactimageAll versions (No fix recorded)
- kodiAll versions (No fix recorded)
Redhat6 products
- enterprise_linuxEOL7.0 | 8.0 | 9.0
- LibRaw< 0:0.21.1-1.el9
- LibRaw-debuginfo< 0:0.21.1-1.el9
- LibRaw-debugsource< 0:0.21.1-1.el9
- LibRaw-devel< 0:0.21.1-1.el9
Suse4 products
- libraw&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP4< 0.20.2-150400.3.6.1
- libraw&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 0.15.4-39.1
- libraw&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 0.15.4-39.1
- libraw&distro=SUSE Linux Enterprise Workstation Extension 15 SP4< 0.20.2-150400.3.6.1 | < 0.18.9-150000.3.20.1
Opensuse2 products
- libraw&distro=openSUSE Leap 15.4< 0.20.2-150400.3.6.1 | < 0.18.9-150000.3.20.1
- libraw&distro=openSUSE Tumbleweed< 0.21.1-2.1
Debian1 product
- libraw< 0.20.2-2.1
Fedoraproject1 product
- fedoraEOL37 | 38
Libraw1 product
- libraw< 0.21.2
7 vendors · 23 products
