CVE-2015-3885
Fixed in a distro release EPSS 5%
Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
Products: dcraw_project dcraw, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | darktable | 1.6.7-1 |
| Debian 12 | dcraw | 9.26-1 |
| Debian 12 | exactimage | 0.9.1-5 |
| Debian 12 | freeimage | 3.15.4-6 |
| Debian 12 | kodi | 16.0+dfsg1-1 |
| Debian 12 | libraw | 0.16.2-1 |
| Debian 12 | rawtherapee | 4.2-2 |
| Debian 13 | darktable | 1.6.7-1 |
| Debian 13 | dcraw | 9.26-1 |
| Debian 13 | exactimage | 0.9.1-5 |
| Debian 13 | freeimage | 3.15.4-6 |
| Debian 13 | kodi | 16.0+dfsg1-1 |
| Debian 13 | libraw | 0.16.2-1 |
| Debian 13 | rawtherapee | 4.2-2 |
| Debian 14 | darktable | 1.6.7-1 |
| Debian 14 | dcraw | 9.26-1 |
| Debian 14 | exactimage | 0.9.1-5 |
| Debian 14 | kodi | 16.0+dfsg1-1 |
| Debian 14 | libraw | 0.16.2-1 |
| Debian 14 | rawtherapee | 4.2-2 |
| Debian 6.0 | exactimage | 0.8.1-3+deb6u4 |
| Debian 6.0 | libraw | 0.9.1-1+deb6u1 |
| Debian 8 | freeimage | 3.15.4-4.2+deb8u1 |
| SUSE Linux Enterprise Desktop 12 SP2 | libraw | 0.15.4-9.2 |
| SUSE Linux Enterprise Desktop 12 SP3 | libraw | 0.15.4-9.2 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | libraw | 0.15.4-45.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | libraw | 0.15.4-9.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libraw | 0.15.4-9.2 |
| SUSE Linux Enterprise Workstation Extension 12 SP2 | libraw | 0.15.4-9.2 |
| SUSE Linux Enterprise Workstation Extension 12 SP3 | libraw | 0.15.4-9.2 |
| Ubuntu 14.04 LTS | libraw | 0.15.4-1ubuntu0.1 |
| Ubuntu 16.04 LTS | dcraw | no fix |
| Ubuntu 16.04 LTS | kodi | no fix |
| Ubuntu 16.04 LTS | libraw | 0.17.1-1ubuntu0.1 |
| Ubuntu 24.04 LTS | kodi | no fix |
| Ubuntu 26.04 LTS | kodi | no fix |
| Ubuntu Pro 14.04 LTS | freeimage | 3.15.4-3ubuntu0.1+esm2 |
| openSUSE Tumbleweed | rawtherapee | 5.8-5.1 |