PT-2024-24140 · Freeimage+2 · Freeimage+2

Michael Knap · Published 2024-09-19 · Updated 2024-09-25 · CVE-2024-31570

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeImage versions 3.4.0 through 3.18.0

Description The issue is a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file. This occurs in the libfreeimage library.

Recommendations For versions 3.4.0 through 3.18.0, consider disabling the Load function in PluginXPM.cpp to prevent exploitation until a patch is available. Restrict access to XPM files to minimize the risk of triggering the buffer overflow.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2024-31570

Affected Products

Debian

Freeimage

Libfreeimage

References · 16

• https://osv.dev/vulnerability/DEBIAN-CVE-2024-31570 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31570 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31570 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-31570 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-31570 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-31570 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-31570 · Vendor Advisory
• https://sourceforge.net/p/freeimage/bugs/355 · Note
• https://twitter.com/cracbot/status/1838458397844475935 · Twitter Post
• https://t.me/cvedetector/6065 · Telegram Post
• https://marc.info/?l=oss-security&m=171284642816463 · Note
• https://twitter.com/CVEnew/status/1836811076102508675 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1837077917366354117 · Twitter Post
• https://openwall.com/lists/oss-security/2024/04/11/10 · Note
• https://t.me/cvenotify/95307 · Telegram Post