Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia: 2020-0019 Moderate: FreeImage Stack Exhaustion Vulnerability Fix

mageia
Calendar Grey January 5, 2020
Dist Mageia Esm H88
Mageia security update MGASA-2020-0021 addresses vulnerabilities in OpenSSL, impacting data integrity and confidentiality.
The updated packages fix security vulnerabilities: When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs ...

Summary

The updated packages fix security vulnerabilities:
When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs in which the destination address and the size of the copied data are not considered, resulting in a heap overflow. (CVE-2019-12211)
When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaustion. (CVE-2019-12213)

References

- https://bugs.mageia.org/show_bug.cgi?id=25967

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/56P2TDRB2FEJEWDRIAOPGEDF7L2VNA7B/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/PUWVVP67FYM4GMWD7TPQ7C7JPPRUZHYE/

- https://www.cve.org/CVERecord?id=CVE-2019-12211

- https://www.cve.org/CVERecord?id=CVE-2019-12213

Topics%20covered

Topics Covered

security advisory heap overflow stack exhaustion FreeImage Mageia

Resolution

SRPMS

- 7/core/freeimage-3.18.0-2.mga7

Publication date: 05 Jan 2020
URL: https://advisories.mageia.org/MGASA-2020-0019.html
Type: security
CVE: CVE-2019-12211, CVE-2019-12213

Topics%20covered

Topics Covered

security advisory heap overflow stack exhaustion FreeImage Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here