[Git][security-tracker-team/security-tracker][master] Add some freeimage URL patch references from fedora

[Santiago R.R. (@santiago)]

Santiago R.R. pushed to branch master at Debian Security Tracker / security-tracker


Commits:
20155252 by Santiago Ruano Rincón at 2024-04-09T13:33:50-03:00
Add some freeimage URL patch references from fedora

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -21970,6 +21970,7 @@ CVE-2023-47997 (An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitma
 	[bullseye] - freeimage <postponed> (Revisit when fixed upstream)
 	[buster] - freeimage <postponed> (Revisit when fixed upstream)
 	NOTE: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47997
+	NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2023-47997.patch
 CVE-2023-47996 (An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in F ...)
 	- freeimage <unfixed> (bug #1060691)
 	[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -21982,6 +21983,7 @@ CVE-2023-47995 (Memory Allocation with Excessive Size Value discovered in Bitmap
 	[bullseye] - freeimage <postponed> (Revisit when fixed upstream)
 	[buster] - freeimage <postponed> (Revisit when fixed upstream)
 	NOTE: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47995
+	NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2023-47995.patch
 CVE-2023-47994 (An integer overflow vulnerability in LoadPixelDataRLE4 function in Plu ...)
 	- freeimage <unfixed> (bug #1060691)
 	[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -188683,6 +188685,7 @@ CVE-2021-40266 (FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp
 	[bullseye] - freeimage <no-dsa> (Minor issue)
 	[buster] - freeimage <no-dsa> (Minor issue)
 	NOTE: https://sourceforge.net/p/freeimage/bugs/334/
+	NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2021-40266.patch
 CVE-2021-40265 (A heap overflow bug exists FreeImage before 1.18.0 via ofLoad function ...)
 	- freeimage <unfixed> (bug #1055304)
 	[bookworm] - freeimage <no-dsa> (Minor issue)
@@ -188701,6 +188704,7 @@ CVE-2021-40263 (A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad
 	[bullseye] - freeimage <no-dsa> (Minor issue)
 	[buster] - freeimage <no-dsa> (Minor issue)
 	NOTE: https://sourceforge.net/p/freeimage/bugs/336/
+	NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2021-40263.patch
 CVE-2021-40262 (A stack exhaustion issue was discovered in FreeImage before 1.18.0 via ...)
 	- freeimage <unfixed> (bug #1055301)
 	[bookworm] - freeimage <no-dsa> (Minor issue)
@@ -205900,6 +205904,7 @@ CVE-2021-33367 (Buffer Overflow vulnerability in Freeimage v3.18.0 allows attack
 	[bullseye] - freeimage <no-dsa> (Minor issue)
 	[buster] - freeimage <no-dsa> (Minor issue)
 	NOTE: https://sourceforge.net/p/freeimage/discussion/36109/thread/1a4db03d58/
+	NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2021-33367.patch
 CVE-2021-33366 (Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC  ...)
 	{DSA-5411-1}
 	- gpac <unfixed> (unimportant)
@@ -261315,6 +261320,7 @@ CVE-2020-24295 (Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine()
 	[bullseye] - freeimage <postponed> (Revisit when patches are available)
 	[buster] - freeimage <postponed> (Revisit when patches are available)
 	NOTE: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
+	NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2020-24295.patch
 CVE-2020-24294 (Buffer Overflow vulnerability in psdParser::UnpackRLE function in PSDP ...)
 	- freeimage <unfixed> (bug #1059152)
 	[bookworm] - freeimage <postponed> (Revisit when patches are available)
@@ -261327,12 +261333,14 @@ CVE-2020-24293 (Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser
 	[bullseye] - freeimage <postponed> (Revisit when patches are available)
 	[buster] - freeimage <postponed> (Revisit when patches are available)
 	NOTE: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
+	NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2020-24293.patch
 CVE-2020-24292 (Buffer Overflow vulnerability in load function in PluginICO.cpp in Fre ...)
 	- freeimage <unfixed> (bug #1059152)
 	[bookworm] - freeimage <postponed> (Revisit when patches are available)
 	[bullseye] - freeimage <postponed> (Revisit when patches are available)
 	[buster] - freeimage <postponed> (Revisit when patches are available)
 	NOTE: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
+	NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2020-24292.patch
 CVE-2020-24291
 	RESERVED
 CVE-2020-24290



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/20155252d58b523a2946a35fa181f9e96ef36d78

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/20155252d58b523a2946a35fa181f9e96ef36d78
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240409/55a5fa96/attachment.htm>