[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 11 Apr 2024 14:40:02 +0000
From: Michael Knap <oss-sec@...ap.com>
To: "billchenchina2001@...il.com" <billchenchina2001@...il.com>
Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow
On Thursday, April 11th, 2024 at 10:02 AM, Michael Knap <oss-sec@...ap.com> wrote:
>
>
>
>
> -------- Original Message --------
> On 11/04/2024 09:22, Tianyu Chen wrote:
>
> > Hi Michael,
> > I believe there may be a duplicate report for freeimage that you should be aware of. You can find it at the following link:
> >
> > https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
> >
> > The linked report includes CVE-2024-28562, CVE-2024-28563, CVE-2024-28564, CVE-2024-28565, and more up to CVE-2024-28584.
> >
> > Best regards,
> > Tianyu Chen
>
>
> Hi Tianyu,
>
> Indeed, it seems so! I apologize for any inconvenience this may have caused.
>
> I conducted a search on MITRE for the library and found several current CVEs,
> but I did not come across this specific report. Given that they are fairly recent,
> there might have been a period during which they were not yet visible in public searches.
>
> Thank you for bringing this to my attention!
>
> Best regards,
> Michael Knap
I have reviewed the CVE range mentioned by Tianyu, and it appears the XPM buffer overflow
hasn't been assigned. The repository Tianyu linked does indeed include the sprintf buffer
overflow vulnerability in the XPM parser.
'''
### Vulnerability 22
Vulnerability Type: buffer overflow
Impact: command execution
Affected component: PluginXPM.cpp, Load()
Description: In FreeImage library version 3.19.0 [r1909], when reading images in XPM format,
the Load() function has a stack overflow write vulnerability, which may lead to
a command execution.
Trace:
case10231: [WRITE,stack-buffer-overflow]@main->FreeImage_Load->FreeImage_LoadFromHandle->Load->sprintf
'''
The CVE has just now been assigned and credited to me,
but it seems it should have been assigned along with the others in that repository.
Not sure what caused the issue and why it wasn't originally assigned with the others,
reported by Ruanxingzhi. I will contact MITRE with clarification and request to change the credit.
The assigned CVE: CVE-2024-31570.
Best regards,
Michael Knap
Download attachment "publickey - oss-sec@...ap.com - 0xDF4CFAF0.asc" of type "application/pgp-keys" (641 bytes)
Download attachment "signature.asc" of type "application/pgp-signature" (250 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
