ALAS2-2025-2974

Amazon Linux 2 Security Advisory: ALAS2-2025-2974
Advisory Released Date: 2025-08-19
Advisory Updated Date: 2025-08-19
Severity: Medium
Issue Overview:

In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. (CVE-2025-43961)

In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations. (CVE-2025-43962)

In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing. (CVE-2025-43963)


Affected Packages:

LibRaw


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update LibRaw or yum update --advisory ALAS2-2025-2974 to update your system.

New Packages:
aarch64:
    LibRaw-0.19.4-1.amzn2.0.5.aarch64
    LibRaw-devel-0.19.4-1.amzn2.0.5.aarch64
    LibRaw-static-0.19.4-1.amzn2.0.5.aarch64
    LibRaw-debuginfo-0.19.4-1.amzn2.0.5.aarch64

i686:
    LibRaw-0.19.4-1.amzn2.0.5.i686
    LibRaw-devel-0.19.4-1.amzn2.0.5.i686
    LibRaw-static-0.19.4-1.amzn2.0.5.i686
    LibRaw-debuginfo-0.19.4-1.amzn2.0.5.i686

src:
    LibRaw-0.19.4-1.amzn2.0.5.src

x86_64:
    LibRaw-0.19.4-1.amzn2.0.5.x86_64
    LibRaw-devel-0.19.4-1.amzn2.0.5.x86_64
    LibRaw-static-0.19.4-1.amzn2.0.5.x86_64
    LibRaw-debuginfo-0.19.4-1.amzn2.0.5.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2025-43961, CVE-2025-43962, CVE-2025-43963

Mitre: CVE-2025-43961, CVE-2025-43962, CVE-2025-43963