Description
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
danoli3 FreeImage
Default version status: unaffected
0 to ≤ 3.19.23affected
pkg:github/danoli3/FreeImageFreeImage FreeImage
Default version status: unaffected
0 to ≤ 3.18.0affected
References
- https://hackmd.io/@haind-pwn/freeimage-pict-unpack32bits-plane-conversion-oob-read ↗
- https://github.com/danoli3/FreeImage/blob/cc2bfc1b67d3a10e2c203c56932b09ffb52a4477/Source/FreeImage/PluginPICT.cpp#L605-L650 ↗
- https://github.com/danoli3/FreeImage ↗
- https://www.vulncheck.com/advisories/freeimage-through-3.19.23-heap-out-of-bounds-read-via-pict-unpack32bits ↗