CVE-2020-15365

LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds.

Versions of LibRaw shipped with Red Hat Enterprise Linux 7 and 8 are not affected by this flaw because the vulnerable code was introduced in a newer version of LibRaw. CR3 support was not introduced until 0.20-RC1 and the older exif code does not have the same logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.