Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade freeimageUpgrade librawUpgrade darktableUpgrade exactimageUpgrade dcrawUpgrade rawtherapeeUpgrade kodi | Oct 14, 2016 | May 19, 2015 |
| Freebsd | — | Upgrade lightzoneUpgrade freeimageUpgrade kodiUpgrade flphotoUpgrade exact-imageUpgrade netpbmUpgrade dcrawUpgrade opengtlUpgrade ufrawUpgrade darktableUpgrade librawUpgrade rawstudioUpgrade cinepaintUpgrade dcraw-m | Dec 10, 2025 | May 15, 2015 |
| Gentoo Linux | — | Upgrade media-libs/libraw.Upgrade media-gfx/dcraw.Upgrade media-tv/kodi. | Oct 30, 2017 | May 19, 2015 |
| Huawei Euleros 2_0_sp2 | — | Upgrade dcraw | Dec 4, 2019 | May 19, 2015 |
| Huawei Euleros 2_0_sp3 | — | Upgrade dcraw | Dec 18, 2019 | May 19, 2015 |
| Oracle Solaris | — | Upgrade image/dcraw to version 8.99-0.175.3.7.0.2.0 on Solaris 11.3 | May 29, 2017 | May 19, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 11, 2015 |
| Suse | — | Upgrade libraw-devel-staticUpgrade libraw-develUpgrade libraw9 | Dec 18, 2015 | May 19, 2015 |
| Ubuntu | — | Upgrade libraw9Upgrade libraw16Upgrade libraw15 | Nov 23, 2017 | May 19, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub