PT-2015-6336 · Dave Coffin+2 · Dcraw+2

Eduardo Castellanos · Publicado 2015-05-13 · Atualizado 2025-04-28 · CVE-2015-3885

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions dcraw versions 7.00 and earlier

Description The issue is related to an integer overflow in the ljpeg start function, which can be triggered by a crafted image. This overflow is associated with the len variable and can cause a denial of service (crash) due to a buffer overflow.

Recommendations For dcraw versions 7.00 and earlier, update to a version later than 7.00 to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2015-3885

DLA-228-1

DLA-243-1

DSA-3692-1

MGASA-2015-0222

MGASA-2015-0224

MGASA-2015-0225

MGASA-2015-0226

MGASA-2015-0230

MGASA-2016-0373

OPENSUSE-SU-2024:10478-1

OPENSUSE-SU-2024:10588-1

SUSE-SU-2017:2300-1

SUSE-SU-2017_2300-1

SUSE-SU-2025:1380-1

SUSE-SU-2025_1380-1

USN-3492-1

Produtos afetados

Suse

Ubuntu

Dcraw

Referências · 80

• https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5 · Nota
• https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e · Nota
• https://bugzilla.suse.com/957517 · Nota
• https://suse.com/support/update/announcement/2025/suse-su-20251380-1 · Nota
• https://suse.com/security/cve/CVE-2025-43962 · Nota
• http://talosintelligence.com/reports/TALOS-2016-0189 · Nota
• https://ubuntu.com/security/CVE-2015-8366 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159479.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-3885 · Nota de Segurança
• http://securityfocus.com/archive/1/535513/100/0/threaded · Nota
• https://advisories.mageia.org/MGASA-2016-0373.html · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159469.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159123.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-6887 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2017:2300-1 · Aviso do Fabricante