+++ This bug was initially created as a clone of Bug #15910 +++ An advisory has been issued today (May 11): http://www.ocert.org/advisories/ocert-2015-006.html Patched packages uploaded for Mageia 4 and Cauldron. Advisory: ======================== Updated rawtherapee package fixes security vulnerability: The dcraw tool suffers from an integer overflow condition which lead to a buffer overflow. The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition (CVE-2015-3885). The rawtherapee package contains a bundled copy of the affected code and has been patched to fix this issue. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3885 http://www.ocert.org/advisories/ocert-2015-006.html ======================== Updated packages in core/updates_testing: ======================== rawtherapee-4.0.11-2.2.mga4 from rawtherapee-4.0.11-2.2.mga4.src.rpm
Similar to darktable. Can be tested by opening various raw type images.
Whiteboard: (none) => has_procedure
Testing complete mga4 64
Whiteboard: has_procedure => has_procedure mga4-64-ok
Testing complete mga4 32
Whiteboard: has_procedure mga4-64-ok => has_procedure mga4-32-ok mga4-64-ok
Validating. Advisory uploaded. Please push to 4 updates Thanks
Keywords: (none) => validated_updateWhiteboard: has_procedure mga4-32-ok mga4-64-ok => has_procedure advisory mga4-32-ok mga4-64-okCC: (none) => sysadmin-bugs
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0226.html
Status: NEW => RESOLVEDResolution: (none) => FIXED
URL: (none) => http://lwn.net/Vulnerabilities/644511/