PT-2015-6336 · Dave Coffin+2 · Dcraw+2

Eduardo Castellanos · Published 2015-05-13 · Updated 2025-04-28 · CVE-2015-3885

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions dcraw versions 7.00 and earlier

Description The issue is related to an integer overflow in the ljpeg start function, which can be triggered by a crafted image. This overflow is associated with the len variable and can cause a denial of service (crash) due to a buffer overflow.

Recommendations For dcraw versions 7.00 and earlier, update to a version later than 7.00 to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2015-3885

DLA-228-1

DLA-243-1

DSA-3692-1

MGASA-2015-0222

MGASA-2015-0224

MGASA-2015-0225

MGASA-2015-0226

MGASA-2015-0230

MGASA-2016-0373

OPENSUSE-SU-2024:10478-1

OPENSUSE-SU-2024:10588-1

SUSE-SU-2017:2300-1

SUSE-SU-2017_2300-1

SUSE-SU-2025:1380-1

SUSE-SU-2025_1380-1

USN-3492-1

Affected Products

Suse

Ubuntu

Dcraw

References · 80

• https://ubuntu.com/security/CVE-2015-8366 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159479.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3885 · Security Note
• https://advisories.mageia.org/MGASA-2016-0373.html · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159469.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159123.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6887 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2300-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0226 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0226.html · Security Note
• https://ubuntu.com/security/CVE-2017-14348 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-3885 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-3885 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1380-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-3885 · Vendor Advisory