freeimage: CVE-2020-21426

Debian Bug report logs - #1051736
freeimage: CVE-2020-21426

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: submit@bugs.debian.org

Subject: freeimage: CVE-2020-21426

Date: Mon, 11 Sep 2023 23:01:23 +0200

Source: freeimage
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for freeimage.

CVE-2020-21426[0]:
| Buffer Overflow vulnerability in function C_IStream::read in
| PluginEXR.cpp in FreeImage 3.18.0 allows remote attackers to run
| arbitrary code and cause other impacts via crafted image file.

https://sourceforge.net/p/freeimage/bugs/300/

The bug mentions "fixed in the SVN" version, but it's unclear with which
commit and when.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-21426
    https://www.cve.org/CVERecord?id=CVE-2020-21426

Please adjust the affected versions in the BTS as needed.

Send a report that this bug log contains spam.