PT-2018-18178 · David Tschumperle · Cimg

Xiaoqx · Published 2018-03-02 · Updated 2020-11-02 · CVE-2018-7639

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CImg version 220

Description A heap-based buffer over-read issue occurs in the load bmp function in CImg.h when loading a crafted bmp image, specifically in the "16 bits colors" case.

Recommendations For version 220, consider avoiding the use of the load bmp function in CImg.h until a patch is available, or refrain from loading crafted bmp images to minimize the risk of exploitation.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2018-7639

DLA-1934-1

DLA-2421-1

MGASA-2018-0438

Affected Products

Cimg

References · 18

• 🔥 https://github.com/dtschump/CImg/issues/185 · Exploit
• https://osv.dev/vulnerability/MGASA-2018-0438 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7639 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7639 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-7639 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0438.html · Security Note
• https://cve.org/CVERecord?id=CVE-2018-7639 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/OCWBP5ZUZHIZXP7IFUEZIJG7Q3VLJXBV · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1934-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7639 · Security Note
• https://osv.dev/vulnerability/DLA-2421-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6Z4EMB7JFEKIYRFRANRNDD7ZIIZP6T4Z · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7639 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7639 · Vendor Advisory
• https://github.com/dtschump/CImg/commit/10af1e8c1ad2a58a0a3342a856bae63e8f257abb · Note