CVE-2015-3885

Updated darktable package fixes security vulnerability

The dcraw tool bundled in darktable's libraw copy suffers from an integer overflow condition which leads to a buffer overflow. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition.

The bundled dcraw code has been patched to fix this vulnerability.

Updated libraw packages fix security vulnerability:

The dcraw tool suffers from an integer overflow condition which lead to a buffer overflow. The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition (CVE-2015-3885).

LibRaw contains a bundled copy of the affected code. The libraw package has been patched to fix this issue.

Updated dcraw and ufraw packages fix security vulnerability:

The dcraw tool suffers from an integer overflow condition which lead to a buffer overflow. The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition (CVE-2015-3885).

The ufraw package also contains the affected code. The dcraw and ufraw packages have been patched to fix this issue.

Updated rawtherapee package fixes security vulnerability:

The dcraw tool suffers from an integer overflow condition which lead to a buffer overflow. The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition (CVE-2015-3885).

The rawtherapee package contains a bundled copy of the affected code and has been patched to fix this issue.

Updated xbmc package fixes security vulnerability:

The dcraw tool suffers from an integer overflow condition which lead to a buffer overflow. The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition (CVE-2015-3885).

The xbmc package contains a bundled copy of the affected code and has been patched to fix this issue.

Multiple vulnerabilities were discovered in the FreeImage multimedia library, which might result in denial of service or the execution of arbitrary code if a malformed XMP or RAW image is processed. (CVE-2015-3885, CVE-2016-5684)

These are all security issues fixed in the darktable-2.0.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rawtherapee-5.8-5.1 package on the GA media of openSUSE Tumbleweed.

This update for libraw fixes the following issues:

• CVE-2015-3885: A specially crafted raw image file could have caused a Denial of Service through an integer overflow. (bsc#930683)

• CVE-2015-8367: The function phase_one_correct() did not handle memory object initialization correctly, which may have caused some other problems. (bsc#957517)

• CVE-2017-6886: memory corruption in parse_tiff_ifd() func (internal/dcraw_common.cpp) could lead to Denial of service (bsc#1039380)

• CVE-2017-6889: integer overflow error within the 'foveon_load_camf()' function (dcraw_foveon.c) could lead to Denial of service (bsc#1039210)

• CVE-2017-6890: boundary error within the 'foveon_load_camf()' function (dcraw_foveon.c) (bsc#1039209)

This update for libraw fixes the following issues:

• CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function (bsc#1241585)
• CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct does not enforce minimum w0 and w1 values (bsc#1241584)

Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.

It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, a remote attacker could cause applications linked against LibRaw to crash, resulting in a denial of service, or possibly execute arbitrary code