CVE catalog

CVE-2017-16909

libraw: CVE-2017-16909

[CVE catalog]

Severity
Medium · CVSS 5.6CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.98% · Oct 25, 2026

An error related to the "LibRaw::panasonic_load_raw()" function (dcraw_common.cpp) in LibRaw versions prior to 0.18.6 can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibrawsid0.22.1-1fixed
Debianlibrawforky0.22.1-1fixed
Debianlibrawtrixie0.21.4-2+deb13u1fixed
Debianlibrawbookworm0.20.2-2.1+deb12u1fixed
Debianlibrawbookworm-security0.20.2-2.1+deb12u2fixed
Ubuntulibraw14.040.15.3-1ubuntu1vulnerable
Ubuntulibraw14.040.15.4-1vulnerable
Ubuntulibraw14.040.15.4-1ubuntu0.1vulnerable
Ubuntulibraw14.040.15.4-1ubuntu0.2fixed
Ubuntulibraw16.040.16.2-1vulnerable
Ubuntulibraw16.040.17.0-1vulnerable
Ubuntulibraw16.040.17.1-1vulnerable
Ubuntulibraw16.040.17.1-1ubuntu0.1vulnerable
Ubuntulibraw16.040.17.1-1ubuntu0.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibrawsourcesid0.18.6-1not yet assignedNot reportedNot reported
Debianlibrawsourceforky0.18.6-1not yet assignedNot reportedNot reported
Debianlibrawsourcetrixie0.18.6-1not yet assignedNot reportedNot reported
Debianlibrawsourcebookworm0.18.6-1not yet assignedNot reportedNot reported
Ubuntulibrawdeb14.040.15.4-1ubuntu0.2Not reportedUSN-3615-1Not reported
Ubuntulibrawdeb16.040.17.1-1ubuntu0.2Not reportedUSN-3615-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libraw20]Fixed

    Source package: [libraw]

    Details (4)

    • 0.20.2-2.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

  • [libraw-bin]Fixed

    Source package: [libraw]

    Details (4)

    • 0.20.2-2.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

  • [libraw-dev]Fixed

    Source package: [libraw]

    Details (4)

    • 0.20.2-2.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

  • [libraw-doc]Fixed

    Source package: [libraw]

    Details (4)

    • 0.20.2-2.1+deb12u1 · all · bookworm

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u1 · all · bookworm

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

    • 0.20.2-2.1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · bookworm; dsa · libraw · debian · 12

[Debian 13 (Trixie)]

  • [libraw23t64]Fixed

    Source package: [libraw]

    Details (2)

    • 0.21.4-2 · amd64 · trixie

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · 13

    • 0.21.4-2 · arm64 · trixie

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · 13

  • [libraw-bin]Fixed

    Source package: [libraw]

    Details (2)

    • 0.21.4-2 · amd64 · trixie

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · 13

    • 0.21.4-2 · arm64 · trixie

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · 13

  • [libraw-dev]Fixed

    Source package: [libraw]

    Details (2)

    • 0.21.4-2 · amd64 · trixie

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · 13

    • 0.21.4-2 · arm64 · trixie

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · 13

  • [libraw-doc]Fixed

    Source package: [libraw]

    Details (2)

    • 0.21.4-2 · all · trixie

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · 13

    • 0.21.4-2 · all · trixie

      Fixed · Fixed: 0.18.6-1

      dsa · libraw · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]