PT-2024-22477 · Freeimage+1 · Freeimage+1

Published 2024-03-19 · Updated 2024-08-02 · CVE-2024-28574

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeImage version 3.19.0

Description The issue allows a local attacker to cause a denial of service (DoS) via the opj j2k copy default tcp and create tcd() function when reading images in J2K format.

Recommendations For FreeImage version 3.19.0, consider disabling the opj j2k copy default tcp and create tcd() function as a temporary workaround until a patch is available. Restrict access to J2K image reading functionality to minimize the risk of exploitation.

Exploit

Fix

DoS

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2024-28574

Affected Products

Debian

Freeimage

References · 9

• 🔥 https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2024-28574 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28574 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28574 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28574 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28574 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28574 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28574 · Security Note
• https://twitter.com/CVEnew/status/1770339393989120031 · Twitter Post