Multiple vulnerabilities were discovered in the FreeImage multimedia library, which might result in denial of service or the execution of arbitrary code if a malformed XMP or RAW image is processed.

According to the version of the dcraw package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Integer overflow in the ljpeg_start function in dcraw     7.00 and earlier allows remote attackers to cause a     denial of service (crash) via a crafted image, which     triggers a buffer overflow, related to the len     variable.(CVE-2015-3885)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3492-1 advisory.

    It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked     into processing a specially crafted photo file, a remote attacker could cause applications linked against     LibRaw to crash, resulting in a denial of service, or possibly execute arbitrary code

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update contains a fix for a bug which could cause dcraw write past array boundaries.

Additionally, it updates dcraw to version 9,25.0 which contains updated color matrices and supports the Canon EOS 5DS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1380-1 advisory.

    - CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phase_one_correct function     (bsc#1241585)
    - CVE-2025-43964: Fixed tag 0x412 processing in phase_one_correct  does not enforce minimum w0 and w1     values (bsc#1241584)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201706-17 (Kodi: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Kodi. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted image       file using Kodi, possibly resulting in a Denial of Service condition.
    Furthermore, a remote attacker could entice a user process a specially       crafted ZIP file containing subtitles using Kodi, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ocert reports :

The dcraw tool, as well as several other projects re-using its code, suffers from an integer overflow condition which lead to a buffer overflow.

The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function.

A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition.

Update to version 0.16.2, see http://www.libraw.org/download#changelog for details. Update to version 0.16.1, see http://www.libraw.org/download#changelog for details. Security fix for CVE-2015-3885.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered in the ExactImage image manipulation programs.

CVE-2015-3885

Eduardo Castellanos discovered an Integer overflow in the dcraw version included in ExactImage. This vulnerability allows remote attackers to cause a denial of service (crash) via a crafted image.

For the oldoldstable distribution (squeeze), these problems have been fixed in version 0.8.1-3+deb6u4.

For the oldstable, stable, and testing distributions, these problems will be fixed soon.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update contains a fix for a bug which could cause dcraw write past array boundaries.

Additionally, it updates ufraw to version 0.21, an upstream bugfix release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rawstudio from github https://github.com/rawstudio/rawstudio/ .

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-54 (DCRaw: Buffer overflow)

    An integer overflow was discovered in the ljpeg_start function in DCRaw.
  Impact :

    Remote attackers, by enticing a user to open a specially crafted image,       could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a     denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len     variable. (CVE-2015-3885)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
94056	Debian DSA-3692-1 : freeimage - security update	Nessus	Debian Local Security Checks	2016/10/14	2026/1/21	high
132284	EulerOS 2.0 SP3 : dcraw (EulerOS-SA-2019-2567)	Nessus	Huawei Local Security Checks	2019/12/19	2024/4/3	medium
104785	Ubuntu 14.04 LTS / 16.04 LTS : LibRaw vulnerabilities (USN-3492-1)	Nessus	Ubuntu Local Security Checks	2017/11/27	2024/8/27	critical
84030	Fedora 21 : dcraw-9.25.0-2.fc21 (2015-8647)	Nessus	Fedora Local Security Checks	2015/6/9	2021/1/11	medium
234920	SUSE SLES12 Security Update : libraw (SUSE-SU-2025:1380-1)	Nessus	SuSE Local Security Checks	2025/4/29	2026/4/30	critical
100943	GLSA-201706-17 : Kodi: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/6/21	2025/12/15	medium
83512	FreeBSD : dcraw -- integer overflow condition (57325ecf-facc-11e4-968f-b888e347c638)	Nessus	FreeBSD Local Security Checks	2015/5/18	2021/1/6	medium
83838	Fedora 22 : mingw-LibRaw-0.16.2-1.fc22 (2015-8444)	Nessus	Fedora Local Security Checks	2015/5/27	2021/1/11	medium
83886	Debian DLA-228-1 : exactimage security update	Nessus	Debian Local Security Checks	2015/5/29	2021/1/11	medium
84033	Fedora 20 : ufraw-0.21-1.fc20 (2015-8706)	Nessus	Fedora Local Security Checks	2015/6/9	2021/1/11	medium
84856	Fedora 21 : rawstudio-2.1-0.1.20150511git983bda1.fc21 (2015-8170)	Nessus	Fedora Local Security Checks	2015/7/20	2021/1/11	medium
96689	GLSA-201701-54 : DCRaw: Buffer overflow	Nessus	Gentoo Local Security Checks	2017/1/23	2026/1/5	medium
218947	Linux Distros Unpatched Vulnerability : CVE-2015-3885	Nessus	Misc.	2025/3/4	2026/7/29	medium

检测

插件搜索

high

medium

critical

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium