CVE-2015-3885 Integer overflow in n/a

Medium 4.3 Published 19 May 2015 Updated 6 Aug 2024

Remote attackers can cause a denial of service via a crafted image triggering an integer overflow in the dcraw library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2015-3885?

CVE-2015-3885 is a medium-severity vulnerability in Fedoraproject Fedora, published on 19 May 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.

Weakness: CWE-189

Which versions are affected by CVE-2015-3885?

It affects 2 products.

Linux distribution packages (1)

rawtherapee openSUSE:Tumbleweed All versions 5.8-5.1

Products include Dcraw Project Dcraw, Fedoraproject Fedora.

How do I fix CVE-2015-3885?

Upgrade to a fixed version.

Is CVE-2015-3885 being exploited?

There is no known exploitation of CVE-2015-3885 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2015-3885, DLA-228-1, DLA-243-1, GHSA-gxxm-8rj8-v8q7, MGASA-2015-0222, MGASA-2015-0224 and 6 more.