PT-2019-12700 · Freeimage+1 · Freeimage+1

Taolaw · Publicado 2019-05-20 · Atualizado 2020-08-24 · CVE-2019-12212

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeImage version 3.18.0

Description The issue arises when processing a specially crafted JXR file, causing the StreamCalcIFDSize function in JXRMeta.c to recursively call itself due to improper file handling, leading to stack exhaustion. This can be exploited by an attacker to achieve a remote denial of service attack by sending a specially constructed file.

Recommendations For FreeImage version 3.18.0, consider avoiding the use of the StreamCalcIFDSize function in JXRMeta.c until a patch is available, or refrain from processing untrusted JXR files to minimize the risk of exploitation.

Exploit

Correção

DoS

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

CVE-2019-12212

Produtos afetados

Debian

Freeimage

Referências · 8

• 🔥 https://sourceforge.net/p/freeimage/discussion/36111/thread/e06734bed5 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-12212 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12212 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-12212 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-12212 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12212 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2019-12212 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12212 · Aviso do Fabricante