CVE-2015-3885
CVE-2015-3885
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
EPSS 5.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
darktable Debian:12
- Affected ranges
- ECOSYSTEM: < 1.6.7-1
Update to 1.6.7-1
darktable Debian:13
- Affected ranges
- ECOSYSTEM: < 1.6.7-1
Update to 1.6.7-1
darktable Debian:14
- Affected ranges
- ECOSYSTEM: < 1.6.7-1
Update to 1.6.7-1
dcraw Debian:12
- Affected ranges
- ECOSYSTEM: < 9.26-1
Update to 9.26-1
dcraw Debian:13
- Affected ranges
- ECOSYSTEM: < 9.26-1
Update to 9.26-1
dcraw Debian:14
- Affected ranges
- ECOSYSTEM: < 9.26-1
Update to 9.26-1
exactimage Debian:12
- Affected ranges
- ECOSYSTEM: < 0.9.1-5
Update to 0.9.1-5
exactimage Debian:13
- Affected ranges
- ECOSYSTEM: < 0.9.1-5
Update to 0.9.1-5
exactimage Debian:14
- Affected ranges
- ECOSYSTEM: < 0.9.1-5
Update to 0.9.1-5
freeimage Debian:12
- Affected ranges
- ECOSYSTEM: < 3.15.4-6
Update to 3.15.4-6
freeimage Debian:13
- Affected ranges
- ECOSYSTEM: < 3.15.4-6
Update to 3.15.4-6
kodi Debian:12
- Affected ranges
- ECOSYSTEM: < 16.0+dfsg1-1
Update to 16.0+dfsg1-1
kodi Debian:13
- Affected ranges
- ECOSYSTEM: < 16.0+dfsg1-1
Update to 16.0+dfsg1-1
kodi Debian:14
- Affected ranges
- ECOSYSTEM: < 16.0+dfsg1-1
Update to 16.0+dfsg1-1
libraw Debian:12
- Affected ranges
- ECOSYSTEM: < 0.16.2-1
Update to 0.16.2-1
libraw Debian:13
- Affected ranges
- ECOSYSTEM: < 0.16.2-1
Update to 0.16.2-1
libraw Debian:14
- Affected ranges
- ECOSYSTEM: < 0.16.2-1
Update to 0.16.2-1
rawtherapee Debian:12
- Affected ranges
- ECOSYSTEM: < 4.2-2
Update to 4.2-2
rawtherapee Debian:13
- Affected ranges
- ECOSYSTEM: < 4.2-2
Update to 4.2-2
rawtherapee Debian:14
- Affected ranges
- ECOSYSTEM: < 4.2-2
Update to 4.2-2
libraw Ubuntu:14.04:LTS
- Versions
- 0.15.3-1ubuntu1
- 0.15.4-1
- Affected ranges
- ECOSYSTEM: < 0.15.4-1ubuntu0.1
Update to 0.15.4-1ubuntu0.1
freeimage Ubuntu:Pro:14.04:LTS
- Versions
- 3.15.1-2build1
- 3.15.1-2build2
- 3.15.4-2
- 3.15.4-3
- 3.15.4-3ubuntu0.1
- 3.15.4-3ubuntu0.1+esm1
- Affected ranges
- ECOSYSTEM: < 3.15.4-3ubuntu0.1+esm2
Update to 3.15.4-3ubuntu0.1+esm2
dcraw Ubuntu:16.04:LTS
- Versions
- 9.21-0.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://www.securityfocus.com/bid/74590
- https://security.gentoo.org/glsa/201706-17
- https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159083.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159469.html
- https://security.gentoo.org/glsa/201701-54
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159518.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159625.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162084.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159665.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159579.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159479.html
- http://www.securityfocus.com/archive/1/535513/100/0/threaded
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159123.html
- http://www.ocert.org/advisories/ocert-2015-006.html
- https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e
- https://nvd.nist.gov/vuln/detail/CVE-2015-3885