A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution.
Created LibRaw tracking bugs for this issue:
Affects: epel-6 [bug 1882342]
Affects: fedora-all [bug 1882341]
Created mingw-LibRaw tracking bugs for this issue:
Affects: fedora-all [bug 1882343]
Correction: affected version should say = 0.20.0.
The vulnerable code was first introduced to LibRaw in 0.20.0. See:
This flaw does not affect LibRaw as shipped with Red Hat Enterprise Linux 7 or 8 as the vulnerable code was introduced in a subsequent version of LibRaw.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):