+++ This bug was initially created as a clone of Bug #15910 +++ An advisory has been issued today (May 11): http://www.ocert.org/advisories/ocert-2015-006.html Patched package uploaded for Mageia 4. Updated package uploaded for Cauldron. Advisory: ======================== Updated libraw packages fix security vulnerability: The dcraw tool suffers from an integer overflow condition which lead to a buffer overflow. The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition (CVE-2015-3885). LibRaw contains a bundled copy of the affected code. The libraw package has been patched to fix this issue. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3885 http://www.ocert.org/advisories/ocert-2015-006.html ======================== Updated packages in core/updates_testing: ======================== libraw-tools-0.15.4-2.1.mga4 libraw9-0.15.4-2.1.mga4 libraw_r9-0.15.4-2.1.mga4 libraw-devel-0.15.4-2.1.mga4 from libraw-0.15.4-2.1.mga4.src.rpm
Can be tested by opening raw type images using shotwell, which requires libraw9, and luminance-hdr, which requires libraw_r9. Also raw-identify from libraw-tools.
Whiteboard: (none) => has_procedure
Testing complete mga4 64 Tested with nomacs rather than shotwell, others as comment 1.
Whiteboard: has_procedure => has_procedure mga4-64-ok
Testing complete mga4 32
Whiteboard: has_procedure mga4-64-ok => has_procedure mga4-32-ok mga4-64-ok
Validating. Advisory uploaded. Please push to 4 updates Thanks
Keywords: (none) => validated_updateWhiteboard: has_procedure mga4-32-ok mga4-64-ok => has_procedure advisory mga4-32-ok mga4-64-okCC: (none) => sysadmin-bugs
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0224.html
Status: NEW => RESOLVEDResolution: (none) => FIXED
URL: (none) => http://lwn.net/Vulnerabilities/644511/