SB2024031134 - Multiple vulnerabilities in FreeImage

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Infinite loop (CVE-ID: CVE-2023-47997)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the FreeImage_AllocateBitmap() function in BitmapAccess.cpp. A remote attacker can consume all available system resources and cause denial of service conditions.

2) Buffer overflow (CVE-ID: CVE-2023-47995)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the FreeImage_AllocateBitmap() function in BitmapAccess.cpp. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47997
• https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47995