PT-2023-12359 · Freeimage+1 · Freeimage+1

0X79H · Published 2023-08-22 · Updated 2024-11-01 · CVE-2021-40266

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeImage versions prior to 1.18.0

Description The issue is related to a null pointer dereference in the ReadPalette function located in PluginTIFF.cpp. This function is part of the FreeImage library, which is used for image processing. The null pointer dereference could potentially lead to crashes or other unintended behavior when handling certain TIFF images.

Recommendations For versions prior to 1.18.0, update to version 1.18.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the ReadPalette function in PluginTIFF.cpp until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-40266

OESA-2024-2305

Affected Products

Debian

Freeimage

References · 20

• 🔥 https://sourceforge.net/p/freeimage/bugs/334 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-24292 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-33367 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24293 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-47997 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-40266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47995 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-40266 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-40266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40266 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24295 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40266 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40266 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6GKMK74POW3RU7F4HLUJE7XEFLQDO35 · Vendor Advisory