Skip to content
OpenAdvisories
Medium ALAS2-2025-2974 3 CVEs

Moderate: LibRaw security update (Amazon Linux 2)

Published Aug 13, 2025 · Updated Aug 19, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-43963: In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing. CVE-2025-43962: In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations. CVE-2025-43961: In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 LibRaw 0:0.19.4-1.amzn2.0.5
Amazon Linux · 2 LibRaw-debuginfo 0:0.19.4-1.amzn2.0.5
Amazon Linux · 2 LibRaw-devel 0:0.19.4-1.amzn2.0.5
Amazon Linux · 2 LibRaw-static 0:0.19.4-1.amzn2.0.5

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43961.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43962.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-43963.html