Heap-based buffer overflow in FreeImage - CVE-2019-12211

Vulnerability identifier: #VU23833

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-12211

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within  the load() function of the PluginTIFF.cpp file. A remote attacker can can create a specially crafted TIFF file, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

FreeImage
Gentoo Linux
Ubuntu
Fedora
freeimage (Debian package)
freeimage (Alpine package)
libfreeimage3 (Ubuntu package)
libfreeimageplus3 (Ubuntu package)
libfreeimageplus-dev (Ubuntu package)
libfreeimage-dev (Ubuntu package)
freeimage
mingw-freeimage

Install update from vendor's SVN.

freeimage (Debian package) - addressed in versions 3.17.0+ds1-5+deb9u1, 3.18.0+ds2-1+deb10u1
freeimage (Alpine package) - update to 3.18.0-r2
libfreeimage3 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.17.0+ds1-5+deb9u1build0.18.04.1, 3.18.0+ds2-9.1ubuntu0.1, 3.18.0+ds2-9ubuntu0.1, 3.18.0+ds2-1ubuntu3.1, 3.18.0+ds2-6ubuntu5.1
libfreeimageplus3 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.17.0+ds1-5+deb9u1build0.18.04.1, 3.18.0+ds2-9.1ubuntu0.1, 3.18.0+ds2-9ubuntu0.1, 3.18.0+ds2-1ubuntu3.1, 3.18.0+ds2-6ubuntu5.1
libfreeimageplus-dev (Ubuntu package) - update to 3.17.0+ds1-5+deb9u1build0.18.04.1
libfreeimage-dev (Ubuntu package) - update to 3.17.0+ds1-5+deb9u1build0.18.04.1
freeimage - addressed in versions 3.18.0-6.fc30, 3.18.0-6.fc31
mingw-freeimage - addressed in versions 3.18.0-7.fc30, 3.18.0-7.fc31

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUWVVP67FYM4GMWD7TPQ7C7JPPRUZHYE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZ7KBYPPNRMX7RRWVJSX4T63E3TFB6TG/
• https://sourceforge.net/p/freeimage/discussion/36111/thread/e06734bed5/

• Multiple vulnerabilities in FreeImage
• Debian update for freeimage
• Heap-based buffer overflow in freeimage (Alpine package)
• Gentoo update for FreeImage
• Ubuntu update for freeimage
• Ubuntu update for freeimage
• Fedora 31 update for freeimage, mingw-freeimage
• Fedora 30 update for freeimage, mingw-freeimage