libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in a certain way

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which     may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you     compile the software in a certain way (CVE-2020-24890)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can
    inject additional commands into normal webapp query. (CVE-2020-24899)

  - libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which
    may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you
    compile the software in a certain way (CVE-2020-24890)

  - In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function
    (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file. (CVE-2020-35530)

  - In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function
    (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file. (CVE-2020-35531)

The remote host is affected by the vulnerability described in GLSA-202010-05 (LibRaw: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in LibRaw. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted image       file using an application linked against LibRaw, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Patch for CVE-2020-24890

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
258152	Linux Distros Unpatched Vulnerability : CVE-2020-24890	Nessus	Misc.	medium
405250	Alpine: multiple libraw packages: security update to 0.20.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405250	Alpine: multiple libraw packages: security update to 0.20.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
141701	GLSA-202010-05 : LibRaw: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
141280	Fedora 33 : LibRaw (2020-2d9d628dd2)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-24890

medium

Tenable Plugins

medium

high

high

high

medium