Description
An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LibRaw | LibRaw-demosaic-pack-GPL2 | 0.x prior to 0.18.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | libraw | 0.15.4-9.2 | SUSE-SU-2017:2300-1 |
| SLES 12 SP2 | libraw | 0.15.4-9.2 | SUSE-SU-2017:2300-1 |
Advisories 1
- SUSE-SU-2017:2300-1 Security update for libraw SUSE / openSUSE Security Updates · Feb 4, 2026