PT-2023-12359 · Freeimage+1 · Freeimage+1

0X79H · Publicado 2023-08-22 · Atualizado 2024-11-01 · CVE-2021-40266

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeImage versions prior to 1.18.0

Description The issue is related to a null pointer dereference in the ReadPalette function located in PluginTIFF.cpp. This function is part of the FreeImage library, which is used for image processing. The null pointer dereference could potentially lead to crashes or other unintended behavior when handling certain TIFF images.

Recommendations For versions prior to 1.18.0, update to version 1.18.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the ReadPalette function in PluginTIFF.cpp until a patch is available.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2021-40266

OESA-2024-2305

Produtos afetados

Debian

Freeimage

Referências · 20

• 🔥 https://sourceforge.net/p/freeimage/bugs/334 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-24292 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2021-33367 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2020-24293 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-47997 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-40266 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-47995 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-40266 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2021-40266 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-40266 · Nota de Segurança
• https://osv.dev/vulnerability/OESA-2024-2305 · Aviso do Fabricante
• https://t.me/cvenotify/57338 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2020-24295 · Nota de Segurança
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2305 · Nota
• https://osv.dev/vulnerability/CVE-2021-40266 · Aviso do Fabricante