CVE-2015-3885 Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to th...
MediumCVSS 4.3
EPSS 5.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/darktable(Debian:12) | < 1.6.7-1 | 1.6.7-1 |
| debian/darktable(Debian:13) | < 1.6.7-1 | 1.6.7-1 |
| debian/darktable(Debian:14) | < 1.6.7-1 | 1.6.7-1 |
| debian/dcraw(Debian:12) | < 9.26-1 | 9.26-1 |
| debian/dcraw(Debian:13) | < 9.26-1 | 9.26-1 |
| debian/dcraw(Debian:14) | < 9.26-1 | 9.26-1 |
| debian/exactimage(Debian:12) | < 0.9.1-5 | 0.9.1-5 |
| debian/exactimage(Debian:13) | < 0.9.1-5 | 0.9.1-5 |
| debian/exactimage(Debian:14) | < 0.9.1-5 | 0.9.1-5 |
| debian/freeimage(Debian:12) | < 3.15.4-6 | 3.15.4-6 |
| debian/freeimage(Debian:13) | < 3.15.4-6 | 3.15.4-6 |
| debian/kodi(Debian:12) | < 16.0+dfsg1-1 | 16.0+dfsg1-1 |
| debian/kodi(Debian:13) | < 16.0+dfsg1-1 | 16.0+dfsg1-1 |
| debian/kodi(Debian:14) | < 16.0+dfsg1-1 | 16.0+dfsg1-1 |
| debian/libraw(Debian:12) | < 0.16.2-1 | 0.16.2-1 |
| debian/libraw(Debian:13) | < 0.16.2-1 | 0.16.2-1 |
| debian/libraw(Debian:14) | < 0.16.2-1 | 0.16.2-1 |
| debian/rawtherapee(Debian:12) | < 4.2-2 | 4.2-2 |
| debian/rawtherapee(Debian:13) | < 4.2-2 | 4.2-2 |
| debian/rawtherapee(Debian:14) | < 4.2-2 | 4.2-2 |
| dcraw project dcraw | <= 7.00 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| ubuntu/kodi(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/kodi(Ubuntu:26.04) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2015-3885 vendor-advisory
- FEDORA-2015-8170 vendor-advisory
- FEDORA-2015-8717 vendor-advisory
- FEDORA-2015-8647 vendor-advisory
- FEDORA-2015-8706 vendor-advisory
- FEDORA-2015-8699 vendor-advisory
- FEDORA-2015-8671 vendor-advisory
- FEDORA-2015-8621 vendor-advisory
- FEDORA-2015-8482 vendor-advisory
- FEDORA-2015-8498 vendor-advisory
- www.ocert.org us-government-resource
- www.oracle.com
- 20150511 [oCERT-2015-006] dcraw input sanitization errors mailing-list
- 74590 vdb-entry
- github.com
- github.com
- GLSA-201701-54 vendor-advisory
- GLSA-201706-17 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-3492-1 vendor-advisory
- www.cve.org
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking