Bug#1103781: libraw: CVE-2025-43961 CVE-2025-43962

[Salvatore Bonaccorso]

Source: libraw
Version: 0.21.3-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for libraw.

CVE-2025-43961[0]:
| In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read
| in the Fujifilm 0xf00c tag parser.


CVE-2025-43962[1]:
| In LibRaw before 0.21.4, phase_one_correct in
| decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412
| processing, related to large w0 or w1 values or the frac and mult
| calculations.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-43961
    https://www.cve.org/CVERecord?id=CVE-2025-43961
[1] https://security-tracker.debian.org/tracker/CVE-2025-43962
    https://www.cve.org/CVERecord?id=CVE-2025-43962
[2] https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore