CVE-2020-24890

libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in a certain way

LibRaw as shipped in Red Hat Enterprise Linux 7 and 8 are not affected by this flaw - the flaw seems to be isolated to the specific compiler version used to build LibRaw by the reporter. Versions of g++ and LibRaw as shipped did not exhibit the flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.