Freeimage up to 1.17.x PluginJPEG.cpp ofLoad heap-based overflow

Summaryinfo

A vulnerability was found in Freeimage up to 1.17.x and classified as critical. Impacted is the function ofLoad of the file PluginJPEG.cpp. Such manipulation leads to heap-based overflow. This vulnerability is documented as CVE-2021-40265. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Freeimage up to 1.17.x. Affected by this issue is the function ofLoad of the file PluginJPEG.cpp. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability.

The weakness was released 08/23/2023. The advisory is shared for download at sourceforge.net. This vulnerability is handled as CVE-2021-40265 since 08/30/2021. There are known technical details, but no exploit is available.

Upgrading to version 1.18.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Freeimage

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion