package/libfreeimage: various vulnerability patches
This package’s last release dates back to July 2018. Since then, a
number of CVEs have accumulated. This patch applies several
vulnerability fixes from the Fedora project. Not all vulnerabilities are
addressed by this patch.
- CVE-2019-12211
When FreeImage 3.18.0 reads a tiff file, it will be handed to the
Load function of the PluginTIFF.cpp file, but a memcpy occurs in
which the destination address and the size of the copied data are
not considered, resulting in a heap overflow.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2019-12211
- CVE-2019-12213
When FreeImage 3.18.0 reads a special TIFF file, the
TIFFReadDirectory function in PluginTIFF.cpp always returns 1,
leading to stack exhaustion.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2019-12213
- CVE-2020-24292
Buffer Overflow vulnerability in load function in PluginICO.cpp in
FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
code via opening of crafted ico file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2020-24292
- https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- CVE-2020-24293
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp
in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
code via opening of crafted psd file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2020-24293
- https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- CVE-2020-24295
Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in
FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary
code via use of crafted psd file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2020-24295
- https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- CVE-2021-33367
Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker
to cause a denial of service via a crafted JXR file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-33367
- https://sourceforge.net/p/freeimage/discussion/36109/thread/1a4db03d58/
- CVE-2021-40263
A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad
function in PluginTIFF.cpp.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-40263
- https://sourceforge.net/p/freeimage/bugs/336/
- CVE-2021-40266
FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is
vulnerabile to null pointer dereference.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-40266
- https://sourceforge.net/p/freeimage/bugs/334/
- CVE-2023-47995
Memory Allocation with Excessive Size Value discovered in
BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0
allows attackers to cause a denial of service.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-47995
- CVE-2023-47997
An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in
FreeImage 3.18.0 leads to an infinite loop and allows attackers to
cause a denial of service.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-47997
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6750719a20)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Thomas Perale
838449ec20