[Git][security-tracker-team/security-tracker][master] Some issues for freeimage fixed in experimental
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sun Oct 18 14:03:56 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
a401272b by Salvatore Bonaccorso at 2026-10-18T15:03:05+02:00
Some issues for freeimage fixed in experimental
But apparently not yet all. Track temporary until fixes land in
unstable.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -442440,6 +442440,7 @@ CVE-2024-28583 (Buffer Overflow vulnerability in open source FreeImage v.3.19.0
NOTE: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
NOTE: https://sourceforge.net/p/freeimage/bugs/384/
CVE-2024-28582 (Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909 ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1068461)
[trixie] - freeimage <postponed> (Revisit when fixed upstream)
[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -442461,6 +442462,7 @@ CVE-2024-28580 (Buffer Overflow vulnerability in open source FreeImage v.3.19.0
NOTE: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
NOTE: https://sourceforge.net/p/freeimage/bugs/381/
CVE-2024-28579 (Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909 ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1068461)
[trixie] - freeimage <postponed> (Revisit when fixed upstream)
[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -459214,6 +459216,7 @@ CVE-2023-50136 (Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allo
CVE-2023-48864 (SEMCMS v4.8 was discovered to contain a SQL injection vulnerability vi ...)
NOT-FOR-US: SEMCMS
CVE-2023-47997 (An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in F ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1060691)
[trixie] - freeimage <postponed> (Revisit when fixed upstream)
[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -459221,6 +459224,7 @@ CVE-2023-47997 (An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitma
NOTE: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47997
NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2023-47997.patch
CVE-2023-47996 (An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in F ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1060691)
[trixie] - freeimage <postponed> (Revisit when fixed upstream)
[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -459228,6 +459232,7 @@ CVE-2023-47996 (An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_di
[buster] - freeimage <postponed> (Revisit when fixed upstream)
NOTE: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47996
CVE-2023-47995 (Memory Allocation with Excessive Size Value discovered in BitmapAccess ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1060862)
[trixie] - freeimage <postponed> (Revisit when fixed upstream)
[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -459236,6 +459241,7 @@ CVE-2023-47995 (Memory Allocation with Excessive Size Value discovered in Bitmap
NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2023-47995.patch
NOTE: https://sourceforge.net/p/freeimage/bugs/360/
CVE-2023-47994 (An integer overflow vulnerability in LoadPixelDataRLE4 function in Plu ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1060691)
[trixie] - freeimage <postponed> (Revisit when fixed upstream)
[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -459244,6 +459250,7 @@ CVE-2023-47994 (An integer overflow vulnerability in LoadPixelDataRLE4 function
NOTE: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47994
NOTE: https://sourceforge.net/p/freeimage/bugs/359/
CVE-2023-47993 (A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in Fre ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1060691)
[trixie] - freeimage <postponed> (Revisit when fixed upstream)
[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -459252,6 +459259,7 @@ CVE-2023-47993 (A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32
NOTE: https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47993
NOTE: https://sourceforge.net/p/freeimage/bugs/358/
CVE-2023-47992 (An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1060691)
[trixie] - freeimage <postponed> (Revisit when fixed upstream)
[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -626459,6 +626467,7 @@ CVE-2021-40268
CVE-2021-40267
RESERVED
CVE-2021-40266 (FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is vul ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1055305)
[trixie] - freeimage <postponed> (Revisit when fixed upstream)
[bookworm] - freeimage <postponed> (Revisit when fixed upstream)
@@ -699178,6 +699187,7 @@ CVE-2020-24297 (httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allow
CVE-2020-24296
RESERVED
CVE-2020-24295 (Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in Fre ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1059152)
[trixie] - freeimage <postponed> (Revisit when patches are available)
[bookworm] - freeimage <postponed> (Revisit when patches are available)
@@ -699185,6 +699195,7 @@ CVE-2020-24295 (Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine()
NOTE: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2020-24295.patch
CVE-2020-24294 (Buffer Overflow vulnerability in psdParser::UnpackRLE function in PSDP ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1059152)
[trixie] - freeimage <postponed> (Revisit when patches are available)
[bookworm] - freeimage <postponed> (Revisit when patches are available)
@@ -699192,6 +699203,7 @@ CVE-2020-24294 (Buffer Overflow vulnerability in psdParser::UnpackRLE function i
[buster] - freeimage <postponed> (Revisit when patches are available)
NOTE: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
CVE-2020-24293 (Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp i ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1059152)
[trixie] - freeimage <postponed> (Revisit when patches are available)
[bookworm] - freeimage <postponed> (Revisit when patches are available)
@@ -699199,6 +699211,7 @@ CVE-2020-24293 (Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser
NOTE: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
NOTE: Patch in Fedora (not upstream'ed): https://src.fedoraproject.org/rpms/freeimage/blob/f39/f/CVE-2020-24293.patch
CVE-2020-24292 (Buffer Overflow vulnerability in load function in PluginICO.cpp in Fre ...)
+ [experimental] - freeimage 4.2.1+ds-1~exp1
- freeimage <unfixed> (bug #1059152)
[trixie] - freeimage <postponed> (Revisit when patches are available)
[bookworm] - freeimage <postponed> (Revisit when patches are available)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a401272b4a2358769a1ca7a7589f61797730ebc2
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a401272b4a2358769a1ca7a7589f61797730ebc2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261018/35a3e074/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list