GCVE - cpe:2.3:a:dcraw_project:dcraw:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:dcraw_project:dcraw:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Dcraw Project (`2f53fbc7-7e6a-5b76-9195-8f832ccd3d4e`)
Product	Dcraw (`dc378c60-264d-5ba0-bdeb-8fed991a5813`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/ncruces/dcraw`	purl2cpe	2026-06-01 10:13:15.058201

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-19655`	vulnerable	2026-06-08 05:11:15.990548	Details available A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remote attacker to cause a control-flow hijack, denial-of-service, or unspecified other impact via a maliciously crafted raw photo file. Published: 2018-11-29T05:00:00.000Z Updated: 2024-08-05T11:44:20.159Z Open on db.gcve.eu Reference links https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906529 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890086 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RD65NMWZ5OQNUIF7CLGKLDG4LVPPMJY7/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XK4SHVVIZT6FHJVHOQSAFJMQWDLMWKDE/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3JX4A5F4DWP6NOEULXQXZ5AIH4GA62U/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19568`	vulnerable	2026-06-08 05:11:15.891418	Details available A floating point exception in kodak_radc_load_raw in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. Published: 2018-11-26T20:00:00.000Z Updated: 2024-09-16T20:37:59.408Z Open on db.gcve.eu Reference links https://seclists.org/oss-sec/2018/q4/165 https://seclists.org/oss-sec/2018/q4/171	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19567`	vulnerable	2026-06-08 05:11:15.891103	Details available A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code. Published: 2018-11-26T20:00:00.000Z Updated: 2024-09-16T22:13:58.796Z Open on db.gcve.eu Reference links https://seclists.org/oss-sec/2018/q4/165 https://seclists.org/oss-sec/2018/q4/171	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19566`	vulnerable	2026-06-08 05:11:15.890698	Details available A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. Published: 2018-11-26T20:00:00.000Z Updated: 2024-09-17T02:00:46.008Z Open on db.gcve.eu Reference links https://seclists.org/oss-sec/2018/q4/165 https://seclists.org/oss-sec/2018/q4/171	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19565`	vulnerable	2026-06-08 05:11:15.890181	Details available A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code or leak private information. Published: 2018-11-26T20:00:00.000Z Updated: 2024-09-16T16:38:32.280Z Open on db.gcve.eu Reference links https://seclists.org/oss-sec/2018/q4/165 https://seclists.org/oss-sec/2018/q4/171	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3885`	vulnerable	2026-06-08 05:06:38.705681	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Dcraw

Notes

PURL mappings

Vulnerability references

Contribute