CVE-2020-35534

In LibRaw, there is a memory corruption vulnerability within the crxFreeSubbandData() function (librawsrcdecoderscrx.cpp) when processing cr3 files.

The product does not properly control the allocation and maintenance of a limited resource.

Name	Vendor	Start Version	End Version
Libraw	Libraw	0.20.0 (including)	0.20.0 (including)
Libraw	Libraw	0.20.0-rc2 (including)	0.20.0-rc2 (including)
Libraw	Libraw	0.20.1 (including)	0.20.1 (including)
Libraw	Libraw	0.20.2 (including)	0.20.2 (including)
Libraw	Libraw	0.21.0-beta1 (including)	0.21.0-beta1 (including)
Darktable	Ubuntu	bionic	*
Darktable	Ubuntu	focal	*
Darktable	Ubuntu	kinetic	*
Darktable	Ubuntu	lunar	*
Darktable	Ubuntu	mantic	*
Darktable	Ubuntu	oracular	*
Darktable	Ubuntu	plucky	*
Darktable	Ubuntu	trusty	*
Darktable	Ubuntu	xenial	*
Dcraw	Ubuntu	bionic	*
Dcraw	Ubuntu	focal	*
Dcraw	Ubuntu	kinetic	*
Dcraw	Ubuntu	lunar	*
Dcraw	Ubuntu	mantic	*
Dcraw	Ubuntu	oracular	*
Dcraw	Ubuntu	plucky	*
Dcraw	Ubuntu	trusty	*
Dcraw	Ubuntu	xenial	*
Digikam	Ubuntu	bionic	*
Digikam	Ubuntu	kinetic	*
Digikam	Ubuntu	lunar	*
Digikam	Ubuntu	mantic	*
Digikam	Ubuntu	trusty	*
Digikam	Ubuntu	upstream	*
Digikam	Ubuntu	xenial	*
Exactimage	Ubuntu	bionic	*
Exactimage	Ubuntu	focal	*
Exactimage	Ubuntu	kinetic	*
Exactimage	Ubuntu	lunar	*
Exactimage	Ubuntu	mantic	*
Exactimage	Ubuntu	oracular	*
Exactimage	Ubuntu	plucky	*
Exactimage	Ubuntu	trusty	*
Exactimage	Ubuntu	xenial	*
Kodi	Ubuntu	bionic	*
Kodi	Ubuntu	focal	*
Kodi	Ubuntu	kinetic	*
Kodi	Ubuntu	lunar	*
Kodi	Ubuntu	mantic	*
Kodi	Ubuntu	oracular	*
Kodi	Ubuntu	plucky	*
Kodi	Ubuntu	xenial	*
Libraw	Ubuntu	trusty	*
Libraw	Ubuntu	upstream	*
Libraw	Ubuntu	xenial	*
Rawtherapee	Ubuntu	bionic	*
Rawtherapee	Ubuntu	focal	*
Rawtherapee	Ubuntu	kinetic	*
Rawtherapee	Ubuntu	lunar	*
Rawtherapee	Ubuntu	mantic	*
Rawtherapee	Ubuntu	oracular	*
Rawtherapee	Ubuntu	plucky	*
Rawtherapee	Ubuntu	trusty	*
Rawtherapee	Ubuntu	xenial	*
Ufraw	Ubuntu	bionic	*
Ufraw	Ubuntu	trusty	*
Ufraw	Ubuntu	xenial	*
Xbmc	Ubuntu	trusty	*

Mitigation of resource exhaustion attacks requires that the target system either:
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.

NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-35534
CWE	https://cwe.mitre.org/data/definitions/400.html

Uncontrolled Resource Consumption