{"id":"CVE-2022-4988","state":"PUBLISHED","title":"Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries","description":"Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries.\n\nAlien::FreeImage contains version 3.17.0 of the FreeImage library from 2017, which has known vulnerabilities such as CVE-2015-0852 and CVE-2025-65803.  The library embeds other images libraries that also have known vulnerabilities.","publishedAt":"2026-05-11T19:04:40.885Z","updatedAt":"2026-05-13T12:56:15.512Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"CISA-ADP"},"assigner":"CPANSec","products":["KMX Alien::FreeImage"],"affected":[{"vendor":"KMX","product":"Alien::FreeImage","packageName":"Alien-FreeImage","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.001","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","repo":"https://github.com/kmx/alien-freeimage"}],"references":["https://freeimage.sourceforge.io/","https://metacpan.org/release/KMX/Alien-FreeImage-1.001/source/src/Source","https://nvd.nist.gov/vuln/detail/CVE-2015-0852","https://nvd.nist.gov/vuln/detail/CVE-2025-65803","https://github.com/kmx/alien-freeimage/issues/4","https://github.com/kmx/alien-freeimage/issues/5"],"weaknesses":["CWE-1395"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/4xxx/CVE-2022-4988.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-4988","state":"PUBLISHED","datePublished":"2026-05-11T19:04:40.885Z","dateUpdated":"2026-05-13T12:56:15.512Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-05-08T07:05:02.847Z"},"containers":{"cna":{"title":"Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries","descriptions":[{"lang":"en","value":"Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries.\n\nAlien::FreeImage contains version 3.17.0 of the FreeImage library from 2017, which has known vulnerabilities such as CVE-2015-0852 and CVE-2025-65803.  The library embeds other images libraries that also have known vulnerabilities."}],"affected":[{"vendor":"KMX","product":"Alien::FreeImage","packageName":"Alien-FreeImage","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.001","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","repo":"https://github.com/kmx/alien-freeimage"}],"references":[{"url":"https://freeimage.sourceforge.io/"},{"url":"https://metacpan.org/release/KMX/Alien-FreeImage-1.001/source/src/Source"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0852","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65803","tags":["vendor-advisory"]},{"url":"https://github.com/kmx/alien-freeimage/issues/4","tags":["issue-tracking"]},{"url":"https://github.com/kmx/alien-freeimage/issues/5","tags":["issue-tracking"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1395","description":"CWE-1395 Dependency on Vulnerable Third-Party Component","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-05-11T19:04:40.885Z"},"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2017-07-11T00:00:00.000Z","value":"Alien::FreeImage released with FreeImage 3.17.0"},{"lang":"en","time":"2022-06-29T00:00:00.000Z","value":"Issues added to git repository regarding security vulnerabilities"},{"lang":"en","time":"2022-06-29T00:00:00.000Z","value":"Several issues added to CPANSA::DB"},{"lang":"en","time":"2026-03-27T00:00:00.000Z","value":"Issues logged with CPANSec"}],"workarounds":[{"lang":"en","value":"The latest version of the FreeImage library is 3.18.0 from 2018, which also appears to have serious vulnerabilities.\n\nUsers are advised to use alternatives."}],"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-05-13T12:55:23.634268Z","id":"CVE-2022-4988","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-13T12:56:15.512Z"}}]}}}