CVE-2015-3885

What it actually does

Integer overflow in the ljpeg_start function triggers a buffer overflow when processing a crafted image file, resulting in application crash.

Why it matters to the business

Systems relying on dcraw for image handling may experience unexpected crashes when processing untrusted files, interrupting workflows and reducing availability of dependent services.

How an attack unfolds

An attacker crafts a malicious image that exploits the integer overflow in ljpeg_start, then delivers the file to a target that processes it with dcraw, causing the buffer overflow and denial of service.

How to fix it

Migrate away from the unmaintained dcraw project to a supported image processing library or application. Apply any available distribution patches for Fedora or equivalent packages and isolate image processing workloads.

How to confirm the fix worked

Confirm dcraw version is newer than 7.00 or replaced entirely. Test image processing pipelines against known crafted samples in an isolated environment to verify absence of crashes.

Typical attack path

1. Craft a malicious image file containing values that trigger the integer overflow in ljpeg_start
2. Deliver the image file to the target environment via email, web, or file share
3. Induce the victim application or user to open or convert the image using dcraw
4. Trigger buffer overflow leading to crash and denial of service

How to detect it

Review system and application logs for dcraw segmentation faults or abrupt terminations when image files are processed; correlate with file access timestamps of untrusted images.

What your security team should do

• Replace dcraw with a maintained decoder across all environments
• Sandbox or restrict image processing to limit impact of crashes
• Add monitoring for dcraw process terminations in logs
• Review and remove any remaining dependencies on dcraw in build or runtime pipelines