In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In LibRaw, there is a memory corruption vulnerability within the crxFreeSubbandData() function     (libraw\src\decoders\crx.cpp) when processing cr3 files. (CVE-2020-35534)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can
    inject additional commands into normal webapp query. (CVE-2020-24899)

  - libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which
    may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you
    compile the software in a certain way (CVE-2020-24890)

  - In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function
    (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file. (CVE-2020-35530)

  - In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function
    (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file. (CVE-2020-35531)

ID	Name	Product	Family	Type	Severity
223580	Linux Distros Unpatched Vulnerability : CVE-2020-35534	Nessus	Misc.	Local	medium
405250	Alpine: multiple libraw packages: security update to 0.20.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
405250	Alpine: multiple libraw packages: security update to 0.20.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2020-35534

medium

Tenable Plugins

medium

high

high