CVE-2013-2126

Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.

• CWE-399

• http://lists.opensuse.org/opensuse-updates/2013-06/msg00193.html
• http://lists.opensuse.org/opensuse-updates/2013-06/msg00195.html
• http://secunia.com/advisories/53547Vendor Advisory
• http://secunia.com/advisories/53883Vendor Advisory
• http://secunia.com/advisories/53888Vendor Advisory
• http://secunia.com/advisories/53938
• http://www.libraw.org/news/libraw-0-15-2
• http://www.openwall.com/lists/oss-security/2013/05/29/7
• http://www.openwall.com/lists/oss-security/2013/06/10/1
• http://www.ubuntu.com/usn/USN-1884-1
• http://www.ubuntu.com/usn/USN-1885-1
• https://github.com/LibRaw/LibRaw/commit/19ffddb0fe1a4ffdb459b797ffcf7f490d28b5a6Exploit, Patch
• http://lists.opensuse.org/opensuse-updates/2013-06/msg00193.html
• http://lists.opensuse.org/opensuse-updates/2013-06/msg00195.html
• http://secunia.com/advisories/53547Vendor Advisory
• http://secunia.com/advisories/53883Vendor Advisory
• http://secunia.com/advisories/53888Vendor Advisory
• http://secunia.com/advisories/53938
• http://www.libraw.org/news/libraw-0-15-2
• http://www.openwall.com/lists/oss-security/2013/05/29/7
• http://www.openwall.com/lists/oss-security/2013/06/10/1
• http://www.ubuntu.com/usn/USN-1884-1
• http://www.ubuntu.com/usn/USN-1885-1
• https://github.com/LibRaw/LibRaw/commit/19ffddb0fe1a4ffdb459b797ffcf7f490d28b5a6Exploit, Patch

Published

Aug 14, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-2120The %{password(...)} macro in pastemacroexpander.cpp in the …8.4
• CVE-2013-2121Eval injection vulnerability in the create method in the Boo…
• CVE-2013-2122The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does…
• CVE-2013-2123The Node access user reference module 6.x-3.x before 6.x-3.5…
• CVE-2013-2124Double free vulnerability in inspect-fs.c in LibguestFS 1.20…
• CVE-2013-2125OpenSMTPD before 5.3.2 does not properly handle SSL sessions…
• CVE-2013-2127Buffer overflow in the exposure correction code in LibRaw be…
• CVE-2013-2128The tcp_read_sock function in net/ipv4/tcp.c in the Linux ke…5.5
• CVE-2013-2129Cross-site scripting (XSS) vulnerability in the Webform modu…
• CVE-2013-2130ZNC 1.0 allows remote authenticated users to cause a denial …
• CVE-2013-2131Format string vulnerability in the rrdtool module 1.4.7 for …
• CVE-2013-2132bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo…