CVE-2015-3885: Dcraw Project Dcraw

Medium severity, CVSS 4.3. EPSS: 5.4% chance of exploitation in the next 30 days.

Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.

Affected products

• Dcraw Project Dcraw: up to and including 7.00
• Fedoraproject Fedora: version 21 only

Published 2015-05-19. Last modified 2026-06-17.