PT-2019-5232 · Freeimage+2 · Freeimage+2

Hugo Lefeuvre · Published 2019-05-20 · Updated 2024-06-15 · CVE-2019-12211

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeImage version 3.18.0

Description The issue occurs when reading a tiff file, which is handled by the Load function of the PluginTIFF.cpp file. A memcpy operation happens where the destination address and the size of the copied data are not considered, resulting in a heap overflow. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For FreeImage version 3.18.0, consider disabling the Load function of the PluginTIFF.cpp file as a temporary workaround until a patch is available. Restrict access to the PluginTIFF.cpp file to minimize the risk of exploitation. Avoid using the affected function to handle tiff files until the issue is resolved.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2020-01975

CVE-2019-12211

DLA-2031-1

DSA-4593-1

MGASA-2020-0019

OPENSUSE-SU-2024:10766-1

USN-4529-1

USN-6586-1

Affected Products

Freeimage

Linuxmint

Ubuntu

References · 39

• 🔥 https://sourceforge.net/p/freeimage/discussion/36111/thread/e06734bed5 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PUWVVP67FYM4GMWD7TPQ7C7JPPRUZHYE · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-12211 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2031-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-12211 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PUWVVP67FYM4GMWD7TPQ7C7JPPRUZHYE · Vendor Advisory
• https://usn.ubuntu.com/4529-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0019.html · Security Note
• https://osv.dev/vulnerability/USN-6586-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12211 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10766-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4529-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6586-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202107-02 · Vendor Advisory