Summary
It was discovered that LibRaw could be made to read out of bounds. An
attacker could possibly use this issue to cause applications using LibRaw
to crash, resulting in a denial of service. (CVE-2025-43961,
CVE-2025-43962, CVE-2025-43963, CVE-2025-43964)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libraw | 0.19.5-1ubuntu1.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | libraw | 0.20.2-2ubuntu2.22.04.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | libraw | 0.21.2-2.1ubuntu0.24.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libraw | 0.17.1-1ubuntu0.5+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libraw | 0.18.8-1ubuntu0.4+esm1 |
Vulnerabilities 4
-
Low 2.9
In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.
-
Low 2.9
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processin…
-
Low 2.9
In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col a…
-
Low 2.9
In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimu…