PT-2019-12700 · Freeimage+1 · Freeimage+1

Taolaw · Published 2019-05-20 · Updated 2020-08-24 · CVE-2019-12212

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeImage version 3.18.0

Description The issue arises when processing a specially crafted JXR file, causing the StreamCalcIFDSize function in JXRMeta.c to recursively call itself due to improper file handling, leading to stack exhaustion. This can be exploited by an attacker to achieve a remote denial of service attack by sending a specially constructed file.

Recommendations For FreeImage version 3.18.0, consider avoiding the use of the StreamCalcIFDSize function in JXRMeta.c until a patch is available, or refrain from processing untrusted JXR files to minimize the risk of exploitation.

Exploit

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2019-12212

Affected Products

Debian

Freeimage

References · 8

• 🔥 https://sourceforge.net/p/freeimage/discussion/36111/thread/e06734bed5 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-12212 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12212 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-12212 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12212 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-12212 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12212 · Vendor Advisory