Resource exhaustion in FreeImage - CVE-2019-12213
Published: May 26, 2019 / Updated: August 29, 2023
Vulnerability identifier: #VU18603
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-12213
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error when processing TIFF files in TIFFReadDirectory() function in PluginTIFF.cpp. A remote attacker can pass a specially crafted TIFF file to the affected application, trigger resource exhaustion and perform a denial of service (DoS) attack.Affected software
FreeImage
Gentoo Linux
Ubuntu
Fedora
freeimage (Debian package)
freeimage (Alpine package)
libfreeimage3 (Ubuntu package)
libfreeimageplus3 (Ubuntu package)
libfreeimageplus-dev (Ubuntu package)
libfreeimage-dev (Ubuntu package)
freeimage
mingw-freeimage
Gentoo Linux
Ubuntu
Fedora
freeimage (Debian package)
freeimage (Alpine package)
libfreeimage3 (Ubuntu package)
libfreeimageplus3 (Ubuntu package)
libfreeimageplus-dev (Ubuntu package)
libfreeimage-dev (Ubuntu package)
freeimage
mingw-freeimage
How to mitigate CVE-2019-12213
Install update from vendor's SVN.
freeimage (Debian package) - addressed in versions 3.17.0+ds1-5+deb9u1, 3.18.0+ds2-1+deb10u1
libfreeimage3 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.17.0+ds1-5+deb9u1build0.18.04.1, 3.18.0+ds2-9.1ubuntu0.1, 3.18.0+ds2-9ubuntu0.1, 3.18.0+ds2-1ubuntu3.1, 3.18.0+ds2-6ubuntu5.1
libfreeimageplus3 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.17.0+ds1-5+deb9u1build0.18.04.1, 3.18.0+ds2-9.1ubuntu0.1, 3.18.0+ds2-9ubuntu0.1, 3.18.0+ds2-1ubuntu3.1, 3.18.0+ds2-6ubuntu5.1
libfreeimageplus-dev (Ubuntu package) - update to 3.17.0+ds1-5+deb9u1build0.18.04.1
libfreeimage-dev (Ubuntu package) - update to 3.17.0+ds1-5+deb9u1build0.18.04.1
freeimage - addressed in versions 3.18.0-6.fc30, 3.18.0-6.fc31
mingw-freeimage - addressed in versions 3.18.0-7.fc30, 3.18.0-7.fc31
libfreeimage3 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.17.0+ds1-5+deb9u1build0.18.04.1, 3.18.0+ds2-9.1ubuntu0.1, 3.18.0+ds2-9ubuntu0.1, 3.18.0+ds2-1ubuntu3.1, 3.18.0+ds2-6ubuntu5.1
libfreeimageplus3 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.17.0+ds1-5+deb9u1build0.18.04.1, 3.18.0+ds2-9.1ubuntu0.1, 3.18.0+ds2-9ubuntu0.1, 3.18.0+ds2-1ubuntu3.1, 3.18.0+ds2-6ubuntu5.1
libfreeimageplus-dev (Ubuntu package) - update to 3.17.0+ds1-5+deb9u1build0.18.04.1
libfreeimage-dev (Ubuntu package) - update to 3.17.0+ds1-5+deb9u1build0.18.04.1
freeimage - addressed in versions 3.18.0-6.fc30, 3.18.0-6.fc31
mingw-freeimage - addressed in versions 3.18.0-7.fc30, 3.18.0-7.fc31