FreeImage up to 1.17.x PluginRAW.cpp Validate stack-based overflow

Summaryinfo

A vulnerability has been found in FreeImage up to 1.17.x and classified as critical. This issue affects the function Validate of the file PluginRAW.cpp. This manipulation causes stack-based overflow. This vulnerability is registered as CVE-2021-40262. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in FreeImage up to 1.17.x. Affected by this vulnerability is the function Validate of the file PluginRAW.cpp. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A stack exhaustion issue was discovered in FreeImage before 1.18.0 via the Validate function in PluginRAW.cpp.

The weakness was published 08/23/2023. It is possible to read the advisory at sourceforge.net. This vulnerability is known as CVE-2021-40262 since 08/30/2021. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.18.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• FreeImage

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion