attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
see table below
Classified as
CWE-129 (Improper Validation of Array Index)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Red Hat
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.4 Extended Update Support
libraw
libraw
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. (NVD)
What to Do
Monitor Red Hat's and libraw's web pages for any future patch releases.