When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs in which the destination address and the size of the copied data are not considered, resulting in a heap overflow.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "libfreeimage-dev": "3.15.4-3ubuntu0.1+esm2", "libfreeimage3-dbg": "3.15.4-3ubuntu0.1+esm2", "libfreeimage3": "3.15.4-3ubuntu0.1+esm2", "libfreeimage3-dbgsym": "3.15.4-3ubuntu0.1+esm2", "libfreeimage-dev-dbgsym": "3.15.4-3ubuntu0.1+esm2" } ] }
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "libfreeimage-dev": "3.17.0+ds1-2ubuntu0.1+esm1", "libfreeimage3-dbg": "3.17.0+ds1-2ubuntu0.1+esm1", "libfreeimage3": "3.17.0+ds1-2ubuntu0.1+esm1", "libfreeimage3-dbgsym": "3.17.0+ds1-2ubuntu0.1+esm1", "libfreeimageplus3-dbgsym": "3.17.0+ds1-2ubuntu0.1+esm1", "libfreeimageplus-dev": "3.17.0+ds1-2ubuntu0.1+esm1", "libfreeimageplus3-dbg": "3.17.0+ds1-2ubuntu0.1+esm1", "libfreeimageplus3": "3.17.0+ds1-2ubuntu0.1+esm1", "libfreeimageplus-doc": "3.17.0+ds1-2ubuntu0.1+esm1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libfreeimage-dev": "3.17.0+ds1-5+deb9u1build0.18.04.1", "libfreeimage3-dbg": "3.17.0+ds1-5+deb9u1build0.18.04.1", "libfreeimage3": "3.17.0+ds1-5+deb9u1build0.18.04.1", "libfreeimageplus3-dbg": "3.17.0+ds1-5+deb9u1build0.18.04.1", "libfreeimageplus-dev": "3.17.0+ds1-5+deb9u1build0.18.04.1", "libfreeimageplus3": "3.17.0+ds1-5+deb9u1build0.18.04.1", "libfreeimageplus-doc": "3.17.0+ds1-5+deb9u1build0.18.04.1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libfreeimage-dev": "3.18.0+ds2-1ubuntu3.1", "libfreeimage3": "3.18.0+ds2-1ubuntu3.1", "libfreeimage3-dbgsym": "3.18.0+ds2-1ubuntu3.1", "libfreeimageplus3-dbgsym": "3.18.0+ds2-1ubuntu3.1", "libfreeimageplus-dev": "3.18.0+ds2-1ubuntu3.1", "libfreeimageplus3": "3.18.0+ds2-1ubuntu3.1", "libfreeimageplus-doc": "3.18.0+ds2-1ubuntu3.1" } ] }