When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaustion.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6586-1 advisory.

    It was discovered that FreeImage incorrectly handled certain memory operations. If a user were tricked     into opening a crafted TIFF file, a remote attacker could use this issue to cause a heap buffer overflow,     resulting in a denial of service attack. This issue only affected Ubuntu 16.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2019-12211)

    It was discovered that FreeImage incorrectly processed images under certain circumstances. If a user were     tricked into opening a crafted TIFF file, a remote attacker could possibly use this issue to cause a stack     exhaustion condition, resulting in a denial of service attack. This issue only affected Ubuntu 16.04 LTS     and Ubuntu 20.04 LTS. (CVE-2019-12213)

    It was discovered that FreeImage incorrectly processed certain images. If a user or automated system were     tricked into opening a specially crafted image file, a remote attacker could possibly use this issue to     cause a denial of service or execute arbitrary code. (CVE-2020-21427, CVE-2020-21428)

    It was discovered that FreeImage incorrectly processed certain images. If a user or automated system were     tricked into opening a specially crafted PFM file, an attacker could possibly use this issue to cause a     denial of service. (CVE-2020-22524)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp
    file, but a memcpy occurs in which the destination address and the size of the copied data are not
    considered, resulting in a heap overflow. (CVE-2019-12211)

  - When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always
    returns 1, leading to stack exhaustion. (CVE-2019-12213)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp
    file, but a memcpy occurs in which the destination address and the size of the copied data are not
    considered, resulting in a heap overflow. (CVE-2019-12211)

  - When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly
    calls itself due to improper processing of the file, eventually causing stack exhaustion. An attacker can
    achieve a remote denial of service attack by sending a specially constructed file. (CVE-2019-12212)

  - When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always
    returns 1, leading to stack exhaustion. (CVE-2019-12213)

  - In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k_read_ppm_v3
    function in j2k.c. The value of l_N_ppm comes from the file read in, and the code does not consider that
    l_N_ppm may be greater than the size of p_header_data. (CVE-2019-12214)

The remote host is affected by the vulnerability described in GLSA-202107-02 (FreeImage: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in FreeImage. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted       image file, could possibly cause a Denial of Service condition or other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4529-1 advisory.

    It was discovered that FreeImage incorrectly handled certain memory

    operations. If a user were tricked into opening a crafted TIFF file, a remote attacker could use this     issue to cause a heap buffer overflow,

    resulting in a denial of service attack. (CVE-2019-12211)

    It was discovered that FreeImage incorrectly processed images under certain circumstances. If a user were     tricked into opening a crafted TIFF file, a remote attacker could possibly use this issue to cause a stack

    exhaustion condition, resulting in a denial of service attack.

    (CVE-2019-12213)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was found that freeimage, a graphics library, was affected by the following two security issues :

  - CVE-2019-12211     Heap buffer overflow caused by invalid memcpy in     PluginTIFF. This flaw might be leveraged by remote     attackers to trigger denial of service or any other     unspecified impact via crafted TIFF data.

  - CVE-2019-12213     Stack exhaustion caused by unwanted recursion in     PluginTIFF. This flaw might be leveraged by remote     attackers to trigger denial of service via crafted TIFF     data.

It was found that freeimage, a graphics library, was affected by the following two security issues :

CVE-2019-12211

Heap buffer overflow caused by invalid memcpy in PluginTIFF. This flaw might be leveraged by remote attackers to trigger denial of service or any other unspecified impact via crafted TIFF data.

CVE-2019-12213

Stack exhaustion caused by unwanted recursion in PluginTIFF. This flaw might be leveraged by remote attackers to trigger denial of service via crafted TIFF data.

For Debian 8 'Jessie', these problems have been fixed in version 3.15.4-4.2+deb8u2.

We recommend that you upgrade your freeimage packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport fixes for CVE-2019-12211 and 2019-12213

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
189086	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : FreeImage vulnerabilities (USN-6586-1)	Nessus	Ubuntu Local Security Checks	high
404484	Alpine: multiple freeimage packages: security update to 3.18.0-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404484	Alpine: multiple freeimage packages: security update to 3.18.0-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400480	Alpine: "FreeImage": security update to 3.18.0-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400480	Alpine: "FreeImage": security update to 3.18.0-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
157042	GLSA-202107-02 : FreeImage: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
140729	Ubuntu 18.04 LTS : FreeImage vulnerabilities (USN-4529-1)	Nessus	Ubuntu Local Security Checks	high
132424	Debian DSA-4593-1 : freeimage - security update	Nessus	Debian Local Security Checks	high
131964	Debian DLA-2031-1 : freeimage security update	Nessus	Debian Local Security Checks	high
131337	Fedora 30 : freeimage / mingw-freeimage (2019-76f546b7b8)	Nessus	Fedora Local Security Checks	high
131335	Fedora 31 : freeimage / mingw-freeimage (2019-655994894e)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-12213

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high