CVE catalog
CVE-2015-3885
libraw: CVE-2015-3885
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 5.44% · Oct 25, 2026
Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | kodi | sid | 2:21.3+dfsg-2 | fixed |
| Debian | kodi | forky | 2:21.3+dfsg-1.3 | fixed |
| Debian | kodi | trixie | 2:21.2+dfsg-4 | fixed |
| Debian | kodi | bookworm | 2:20.1+dfsg-1 | fixed |
| Debian | dcraw | sid | 9.28-8 | fixed |
| Debian | dcraw | forky | 9.28-8 | fixed |
| Debian | dcraw | trixie | 9.28-8 | fixed |
| Debian | dcraw | bookworm | 9.28-3 | fixed |
| Debian | libraw | sid | 0.22.1-1 | fixed |
| Debian | libraw | forky | 0.22.1-1 | fixed |
| Debian | libraw | trixie | 0.21.4-2+deb13u1 | fixed |
| Debian | libraw | bookworm | 0.20.2-2.1+deb12u1 | fixed |
| Debian | libraw | bookworm-security | 0.20.2-2.1+deb12u2 | fixed |
| Debian | darktable | sid | 5.4.1-1 | fixed |
| Debian | darktable | forky | 5.4.1-1 | fixed |
| Debian | darktable | trixie | 5.0.1-2 | fixed |
| Debian | darktable | bookworm | 4.2.1-4 | fixed |
| Debian | freeimage | sid | 3.18.0+ds2-11 | fixed |
| Debian | freeimage | trixie | 3.18.0+ds2-11 | fixed |
| Debian | freeimage | bookworm | 3.18.0+ds2-9+deb12u1 | fixed |
| Debian | freeimage | bookworm-security | 3.18.0+ds2-9+deb12u1 | fixed |
| Debian | exactimage | sid | 1.2.1-3 | fixed |
| Debian | exactimage | forky | 1.2.1-3 | fixed |
| Debian | exactimage | trixie | 1.2.1-2 | fixed |
| Debian | exactimage | bookworm | 1.0.2-11 | fixed |
| Debian | rawtherapee | sid | 5.13-1 | fixed |
| Debian | rawtherapee | forky | 5.13-1 | fixed |
| Debian | rawtherapee | trixie | 5.11-2 | fixed |
| Debian | rawtherapee | bookworm | 5.9-1 | fixed |
| Ubuntu | libraw | 14.04 | 0.15.3-1ubuntu1 | vulnerable |
| Ubuntu | libraw | 14.04 | 0.15.4-1 | vulnerable |
| Ubuntu | libraw | 14.04 | 0.15.4-1ubuntu0.1 | fixed |
| Ubuntu | freeimage | pro | 3.15.1-2build1 | vulnerable |
| Ubuntu | freeimage | pro | 3.15.1-2build2 | vulnerable |
| Ubuntu | freeimage | pro | 3.15.4-2 | vulnerable |
| Ubuntu | freeimage | pro | 3.15.4-3 | vulnerable |
| Ubuntu | freeimage | pro | 3.15.4-3ubuntu0.1 | vulnerable |
| Ubuntu | freeimage | pro | 3.15.4-3ubuntu0.1+esm1 | vulnerable |
| Ubuntu | freeimage | pro | 3.15.4-3ubuntu0.1+esm2 | fixed |
| Ubuntu | dcraw | 16.04 | 9.21-0.2 | vulnerable |
| Ubuntu | kodi | 16.04 | 15.1+dfsg1-3 | vulnerable |
| Ubuntu | kodi | 16.04 | 15.2+dfsg1-1build1 | vulnerable |
| Ubuntu | kodi | 16.04 | 15.2+dfsg1-3 | vulnerable |
| Ubuntu | kodi | 16.04 | 15.2+dfsg1-3ubuntu1 | vulnerable |
| Ubuntu | kodi | 16.04 | 15.2+dfsg1-3ubuntu1.1 | vulnerable |
| Ubuntu | kodi | 24.04 | 2:20.2+dfsg-4 | vulnerable |
| Ubuntu | kodi | 24.04 | 2:20.2+dfsg-4build1 | vulnerable |
| Ubuntu | kodi | 24.04 | 2:20.2+dfsg-4build2 | vulnerable |
| Ubuntu | kodi | 24.04 | 2:20.2+dfsg-4ubuntu1 | vulnerable |
| Ubuntu | kodi | 24.04 | 2:20.3+dfsg-1 | vulnerable |
| Ubuntu | kodi | 24.04 | 2:20.4+dfsg-1 | vulnerable |
| Ubuntu | kodi | 24.04 | 2:20.5+dfsg-1build2 | vulnerable |
| Ubuntu | kodi | 24.04 | 2:20.5+dfsg-1ubuntu1 | vulnerable |
| Ubuntu | kodi | 26.04 | 2:21.2+dfsg-4build2 | vulnerable |
| Ubuntu | kodi | 26.04 | 2:21.2+dfsg-4build3 | vulnerable |
| Ubuntu | kodi | 26.04 | 2:21.2+dfsg-5 | vulnerable |
| Ubuntu | kodi | 26.04 | 2:21.3+dfsg-1 | vulnerable |
| Ubuntu | kodi | 26.04 | 2:21.3+dfsg-1build1 | vulnerable |
| Ubuntu | kodi | 26.04 | 2:21.3+dfsg-1ubuntu1 | vulnerable |
| Ubuntu | libraw | 14.04 | 0.15.3-1ubuntu1 | vulnerable |
| Ubuntu | libraw | 14.04 | 0.15.4-1 | vulnerable |
| Ubuntu | libraw | 14.04 | 0.15.4-1ubuntu0.1 | fixed |
| Ubuntu | libraw | 16.04 | 0.16.2-1 | vulnerable |
| Ubuntu | libraw | 16.04 | 0.17.0-1 | vulnerable |
| Ubuntu | libraw | 16.04 | 0.17.1-1 | vulnerable |
| Ubuntu | libraw | 16.04 | 0.17.1-1ubuntu0.1 | fixed |
| Suse | libraw | linux enterprise server ltss extended security 12 sp5 | 0.15.4-45.1 | fixed |
| Opensuse | rawtherapee | tumbleweed | 5.8-5.1 | fixed |
| Suse | libraw | linux enterprise desktop 12 sp2 | 0.15.4-9.2 | fixed |
| Suse | libraw | linux enterprise desktop 12 sp3 | 0.15.4-9.2 | fixed |
| Suse | libraw | linux enterprise software development kit 12 sp2 | 0.15.4-9.2 | fixed |
| Suse | libraw | linux enterprise software development kit 12 sp3 | 0.15.4-9.2 | fixed |
| Suse | libraw | linux enterprise workstation extension 12 sp2 | 0.15.4-9.2 | fixed |
| Suse | libraw | linux enterprise workstation extension 12 sp3 | 0.15.4-9.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | kodi | source | sid | 16.0+dfsg1-1 | not yet assigned | Not reported | [792299] |
| Debian | kodi | source | forky | 16.0+dfsg1-1 | not yet assigned | Not reported | [792299] |
| Debian | kodi | source | trixie | 16.0+dfsg1-1 | not yet assigned | Not reported | [792299] |
| Debian | kodi | source | bookworm | 16.0+dfsg1-1 | not yet assigned | Not reported | [792299] |
| Debian | dcraw | source | sid | 9.26-1 | not yet assigned | Not reported | [785019] |
| Debian | dcraw | source | forky | 9.26-1 | not yet assigned | Not reported | [785019] |
| Debian | dcraw | source | trixie | 9.26-1 | not yet assigned | Not reported | [785019] |
| Debian | dcraw | source | bookworm | 9.26-1 | not yet assigned | Not reported | [785019] |
| Debian | libraw | source | sid | 0.16.2-1 | not yet assigned | Not reported | [786788] |
| Debian | libraw | source | forky | 0.16.2-1 | not yet assigned | Not reported | [786788] |
| Debian | libraw | source | trixie | 0.16.2-1 | not yet assigned | Not reported | [786788] |
| Debian | libraw | source | bookworm | 0.16.2-1 | not yet assigned | Not reported | [786788] |
| Debian | darktable | source | sid | 1.6.7-1 | not yet assigned | Not reported | [786792] |
| Debian | darktable | source | forky | 1.6.7-1 | not yet assigned | Not reported | [786792] |
| Debian | darktable | source | trixie | 1.6.7-1 | not yet assigned | Not reported | [786792] |
| Debian | darktable | source | bookworm | 1.6.7-1 | not yet assigned | Not reported | [786792] |
| Debian | freeimage | source | sid | 3.15.4-6 | not yet assigned | Not reported | [786790] |
| Debian | freeimage | source | trixie | 3.15.4-6 | not yet assigned | Not reported | [786790] |
| Debian | freeimage | source | bookworm | 3.15.4-6 | not yet assigned | Not reported | [786790] |
| Debian | exactimage | source | sid | 0.9.1-5 | not yet assigned | Not reported | [786785] |
| Debian | exactimage | source | forky | 0.9.1-5 | not yet assigned | Not reported | [786785] |
| Debian | exactimage | source | trixie | 0.9.1-5 | not yet assigned | Not reported | [786785] |
| Debian | exactimage | source | bookworm | 0.9.1-5 | not yet assigned | Not reported | [786785] |
| Debian | rawtherapee | source | sid | 4.2-2 | not yet assigned | Not reported | Not reported |
| Debian | rawtherapee | source | forky | 4.2-2 | not yet assigned | Not reported | Not reported |
| Debian | rawtherapee | source | trixie | 4.2-2 | not yet assigned | Not reported | Not reported |
| Debian | rawtherapee | source | bookworm | 4.2-2 | not yet assigned | Not reported | Not reported |
| Ubuntu | libraw | deb | 14.04 | 0.15.4-1ubuntu0.1 | Not reported | UBUNTU-CVE-2015-3885 | Not reported |
| Ubuntu | freeimage | deb | pro | 3.15.4-3ubuntu0.1+esm2 | Not reported | UBUNTU-CVE-2015-3885 | Not reported |
| Ubuntu | libraw | deb | 14.04 | 0.15.4-1ubuntu0.1 | Not reported | USN-3492-1 | Not reported |
| Ubuntu | libraw | deb | 16.04 | 0.17.1-1ubuntu0.1 | Not reported | USN-3492-1 | Not reported |
| Suse | libraw | rpm | linux enterprise server ltss extended security 12 sp5 | 0.15.4-45.1 | Not reported | SUSE-SU-2025:1380-1 | Not reported |
| Opensuse | rawtherapee | rpm | tumbleweed | 5.8-5.1 | Not reported | OPENSUSE-SU-2024:10588-1 | Not reported |
| Suse | libraw | rpm | linux enterprise desktop 12 sp2 | 0.15.4-9.2 | Not reported | SUSE-SU-2017:2300-1 | Not reported |
| Suse | libraw | rpm | linux enterprise desktop 12 sp3 | 0.15.4-9.2 | Not reported | SUSE-SU-2017:2300-1 | Not reported |
| Suse | libraw | rpm | linux enterprise software development kit 12 sp2 | 0.15.4-9.2 | Not reported | SUSE-SU-2017:2300-1 | Not reported |
| Suse | libraw | rpm | linux enterprise software development kit 12 sp3 | 0.15.4-9.2 | Not reported | SUSE-SU-2017:2300-1 | Not reported |
| Suse | libraw | rpm | linux enterprise workstation extension 12 sp2 | 0.15.4-9.2 | Not reported | SUSE-SU-2017:2300-1 | Not reported |
| Suse | libraw | rpm | linux enterprise workstation extension 12 sp3 | 0.15.4-9.2 | Not reported | SUSE-SU-2017:2300-1 | Not reported |
[Debian bug #792299][Debian bug #785019][Debian bug #786788][Debian bug #786792][Debian bug #786790][Debian bug #786785]
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [darktable]Fixed
Details (2)
4.2.1-4· amd64 · bookwormFixed · Fixed:
1.6.7-1dsa · darktable · debian · bookworm; dsa · darktable · debian · 12
4.2.1-4· arm64 · bookwormFixed · Fixed:
1.6.7-1dsa · darktable · debian · bookworm; dsa · darktable · debian · 12
- [dcraw]Fixed
Source package: [dcraw]
Details (2)
9.28-3+b1· amd64 · bookwormFixed · Fixed:
9.26-1dsa · dcraw · debian · bookworm; dsa · dcraw · debian · 12
9.28-3+b1· arm64 · bookwormFixed · Fixed:
9.26-1dsa · dcraw · debian · bookworm; dsa · dcraw · debian · 12
- [exactimage]Fixed
Source package: [exactimage]
Details (2)
1.0.2-11+b2· amd64 · bookwormFixed · Fixed:
0.9.1-5dsa · exactimage · debian · bookworm; dsa · exactimage · debian · 12
1.0.2-11+b2· arm64 · bookwormFixed · Fixed:
0.9.1-5dsa · exactimage · debian · bookworm; dsa · exactimage · debian · 12
- [kodi]Fixed
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-addons-dev]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-addons-dev-common]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-bin]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-data]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-eventclients-common]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-eventclients-dev]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-eventclients-dev-common]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-eventclients-kodi-send]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-eventclients-ps3]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-eventclients-python]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-eventclients-wiiremote]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-eventclients-zeroconf]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-repository-kodi]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· all · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [kodi-tools-texturepacker]Fixed
Source package: [kodi]
Details (2)
2:20.1+dfsg-1· amd64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
2:20.1+dfsg-1· arm64 · bookwormFixed · Fixed:
16.0+dfsg1-1dsa · kodi · debian · bookworm; dsa · kodi · debian · 12
- [libexactimage-perl]Fixed
Source package: [exactimage]
Details (2)
1.0.2-11+b2· amd64 · bookwormFixed · Fixed:
0.9.1-5dsa · exactimage · debian · bookworm; dsa · exactimage · debian · 12
1.0.2-11+b2· arm64 · bookwormFixed · Fixed:
0.9.1-5dsa · exactimage · debian · bookworm; dsa · exactimage · debian · 12
- [libfreeimage3]Fixed
Source package: [freeimage]
Details (4)
3.18.0+ds2-9+deb12u1· amd64 · bookwormFixed · Fixed:
3.15.4-6dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
3.18.0+ds2-9+deb12u1· arm64 · bookwormFixed · Fixed:
3.15.4-6dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
3.18.0+ds2-9+deb12u1· amd64 · bookworm-securityFixed · Fixed:
3.15.4-6dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
3.18.0+ds2-9+deb12u1· arm64 · bookworm-securityFixed · Fixed:
3.15.4-6dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_2300-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2015-3885]
- [https://osv.dev/vulnerability/DLA-228-1]
- [https://osv.dev/vulnerability/DLA-243-1]
- [https://osv.dev/vulnerability/DSA-3692-1]
- [https://osv.dev/vulnerability/SUSE-SU-2017:2300-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:1380-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2015-3885]
- [https://osv.dev/vulnerability/USN-3492-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:10588-1]
- [https://security-tracker.debian.org/tracker/CVE-2015-3885]
- [https://security.access.redhat.com/data/csaf/v2/vex/2015/cve-2015-3885.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]