[<prev] [next>] [day] [month] [year] [list]
Message-ID: <0055b61f-3300-4450-b9fe-f4af5b5af547@cpansec.org>
Date: Mon, 11 May 2026 20:07:32 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2022-4988: Alien::FreeImage versions through 1.001 for Perl
contains several vulnerable libraries
========================================================================
CVE-2022-4988 CPAN Security Group
========================================================================
CVE ID: CVE-2022-4988
Distribution: Alien-FreeImage
Versions: through 1.001
MetaCPAN: https://metacpan.org/dist/Alien-FreeImage
VCS Repo: https://github.com/kmx/alien-freeimage
Alien::FreeImage versions through 1.001 for Perl contains several
vulnerable libraries
Description
-----------
Alien::FreeImage versions through 1.001 for Perl contains several
vulnerable libraries.
Alien::FreeImage contains version 3.17.0 of the FreeImage library from
2017, which has known vulnerabilities such as CVE-2015-0852 and
CVE-2025-65803. The library embeds other images libraries that also
have known vulnerabilities.
Problem types
-------------
- CWE-1395 Dependency on Vulnerable Third-Party Component
Workarounds
-----------
The latest version of the FreeImage library is 3.18.0 from 2018, which
also appears to have serious vulnerabilities.
Users are advised to use alternatives.
References
----------
https://freeimage.sourceforge.io/
https://metacpan.org/release/KMX/Alien-FreeImage-1.001/source/src/Source
https://nvd.nist.gov/vuln/detail/CVE-2015-0852
https://nvd.nist.gov/vuln/detail/CVE-2025-65803
https://github.com/kmx/alien-freeimage/issues/4
https://github.com/kmx/alien-freeimage/issues/5
Timeline
--------
- 2017-07-11: Alien::FreeImage released with FreeImage 3.17.0
- 2022-06-29: Issues added to git repository regarding security
vulnerabilities
- 2022-06-29: Several issues added to CPANSA::DB
- 2026-03-27: Issues logged with CPANSec
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
