oss-sec mailing list archives
Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow
From: Michael Knap <oss-sec () mknap com>
Date: Thu, 11 Apr 2024 14:40:02 +0000
On Thursday, April 11th, 2024 at 10:02 AM, Michael Knap <oss-sec () mknap com> wrote:
-------- Original Message -------- On 11/04/2024 09:22, Tianyu Chen wrote:
Hi Michael, I believe there may be a duplicate report for freeimage that you should be aware of. You can find it at the following link:
https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
The linked report includes CVE-2024-28562, CVE-2024-28563, CVE-2024-28564, CVE-2024-28565, and more up to CVE-2024-28584.
Best regards, Tianyu Chen
Hi Tianyu,
Indeed, it seems so! I apologize for any inconvenience this may have caused.
I conducted a search on MITRE for the library and found several current CVEs, but I did not come across this specific report. Given that they are fairly recent, there might have been a period during which they were not yet visible in public searches.
Thank you for bringing this to my attention!
Best regards, Michael Knap
I have reviewed the CVE range mentioned by Tianyu, and it appears the XPM buffer overflow hasn't been assigned. The repository Tianyu linked does indeed include the sprintf buffer overflow vulnerability in the XPM parser. ''' ### Vulnerability 22 Vulnerability Type: buffer overflow Impact: command execution Affected component: PluginXPM.cpp, Load() Description: In FreeImage library version 3.19.0 [r1909], when reading images in XPM format, the Load() function has a stack overflow write vulnerability, which may lead to a command execution. Trace: case10231: [WRITE,stack-buffer-overflow]@main->FreeImage_Load->FreeImage_LoadFromHandle->Load->sprintf ''' The CVE has just now been assigned and credited to me, but it seems it should have been assigned along with the others in that repository. Not sure what caused the issue and why it wasn't originally assigned with the others, reported by Ruanxingzhi. I will contact MITRE with clarification and request to change the credit. The assigned CVE: CVE-2024-31570. Best regards, Michael Knap
Attachment:
publickey - oss-sec@mknap.com - 0xDF4CFAF0.asc
Description:
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap (Apr 09)
- <Possible follow-ups>
- Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Tianyu Chen (Apr 11)
- Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap (Apr 11)
- Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap (Apr 11)
- Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow Michael Knap (Apr 11)