PT-2024-22484 · Freeimage+1 · Freeimage+1

Published 2024-03-19 · Updated 2024-08-02 · CVE-2024-28580

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeImage version 3.19.0

Description The issue allows a local attacker to execute arbitrary code via the ReadData() function when reading images in RAS format.

Recommendations For FreeImage version 3.19.0, consider disabling the ReadData() function when handling RAS format images until a patch is available. Restrict access to image processing functions to minimize the risk of exploitation.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2024-28580

Affected Products

Debian

Freeimage

References · 9

• 🔥 https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28580 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28580 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28580 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28580 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28580 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28580 · Vendor Advisory
• https://twitter.com/CVEnew/status/1770339399873737051 · Twitter Post