mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 00:04:06 -09:00
4d2210dcfa
This package’s last release dates back to July 2018. Since then, a
number of CVEs have accumulated. This patch applies several
vulnerability fixes from the Fedora project. Not all vulnerabilities are
addressed by this patch.
- CVE-2019-12211
When FreeImage 3.18.0 reads a tiff file, it will be handed to the
Load function of the PluginTIFF.cpp file, but a memcpy occurs in
which the destination address and the size of the copied data are
not considered, resulting in a heap overflow.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2019-12211
- CVE-2019-12213
When FreeImage 3.18.0 reads a special TIFF file, the
TIFFReadDirectory function in PluginTIFF.cpp always returns 1,
leading to stack exhaustion.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2019-12213
- CVE-2020-24292
Buffer Overflow vulnerability in load function in PluginICO.cpp in
FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
code via opening of crafted ico file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2020-24292
- https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- CVE-2020-24293
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp
in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
code via opening of crafted psd file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2020-24293
- https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- CVE-2020-24295
Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in
FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary
code via use of crafted psd file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2020-24295
- https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- CVE-2021-33367
Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker
to cause a denial of service via a crafted JXR file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-33367
- https://sourceforge.net/p/freeimage/discussion/36109/thread/1a4db03d58/
- CVE-2021-40263
A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad
function in PluginTIFF.cpp.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-40263
- https://sourceforge.net/p/freeimage/bugs/336/
- CVE-2021-40266
FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is
vulnerabile to null pointer dereference.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-40266
- https://sourceforge.net/p/freeimage/bugs/334/
- CVE-2023-47995
Memory Allocation with Excessive Size Value discovered in
BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0
allows attackers to cause a denial of service.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-47995
- CVE-2023-47997
An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in
FreeImage 3.18.0 leads to an infinite loop and allows attackers to
cause a denial of service.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-47997
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6750719a20)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
63 lines
1.8 KiB
Makefile
63 lines
1.8 KiB
Makefile
################################################################################
|
|
#
|
|
# libfreeimage
|
|
#
|
|
################################################################################
|
|
|
|
LIBFREEIMAGE_VERSION = 3.18.0
|
|
LIBFREEIMAGE_SITE = http://downloads.sourceforge.net/freeimage
|
|
LIBFREEIMAGE_SOURCE = FreeImage$(subst .,,$(LIBFREEIMAGE_VERSION)).zip
|
|
LIBFREEIMAGE_LICENSE = GPL-2.0 or GPL-3.0 or FreeImage Public License
|
|
LIBFREEIMAGE_LICENSE_FILES = license-gplv2.txt license-gplv3.txt license-fi.txt
|
|
LIBFREEIMAGE_CPE_ID_VENDOR = freeimage_project
|
|
LIBFREEIMAGE_CPE_ID_PRODUCT = freeimage
|
|
LIBFREEIMAGE_INSTALL_STAGING = YES
|
|
|
|
# 0007-CVE-2019-12211_2019-12213.patch
|
|
LIBFREEIMAGE_IGNORE_CVES += CVE-2019-12211 CVE-2019-12213
|
|
|
|
# 0008-CVE-2020-24292.patch
|
|
LIBFREEIMAGE_IGNORE_CVES += CVE-2020-24292
|
|
|
|
# 0009-CVE-2020-24293.patch
|
|
LIBFREEIMAGE_IGNORE_CVES += CVE-2020-24293
|
|
|
|
# 0010-CVE-2020-24295.patch
|
|
LIBFREEIMAGE_IGNORE_CVES += CVE-2020-24295
|
|
|
|
# 0011-CVE-2021-33367.patch
|
|
LIBFREEIMAGE_IGNORE_CVES += CVE-2021-33367
|
|
|
|
# 0012-CVE-2021-40263.patch
|
|
LIBFREEIMAGE_IGNORE_CVES += CVE-2021-40263
|
|
|
|
# 0013-CVE-2021-40266.patch
|
|
LIBFREEIMAGE_IGNORE_CVES += CVE-2021-40266
|
|
|
|
# 0014-CVE-2023-47995.patch
|
|
LIBFREEIMAGE_IGNORE_CVES += CVE-2023-47995
|
|
|
|
# 0016-CVE-2023-47997.patch
|
|
LIBFREEIMAGE_IGNORE_CVES += CVE-2023-47997
|
|
|
|
define LIBFREEIMAGE_EXTRACT_CMDS
|
|
$(UNZIP) $(LIBFREEIMAGE_DL_DIR)/$(LIBFREEIMAGE_SOURCE) -d $(@D)
|
|
mv $(@D)/FreeImage/* $(@D)
|
|
rmdir $(@D)/FreeImage
|
|
endef
|
|
|
|
define LIBFREEIMAGE_BUILD_CMDS
|
|
$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) \
|
|
CXXFLAGS="$(TARGET_CXXFLAGS) -std=c++11" $(MAKE) -C $(@D)
|
|
endef
|
|
|
|
define LIBFREEIMAGE_INSTALL_STAGING_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) DESTDIR=$(STAGING_DIR) install
|
|
endef
|
|
|
|
define LIBFREEIMAGE_INSTALL_TARGET_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) DESTDIR=$(TARGET_DIR) install
|
|
endef
|
|
|
|
$(eval $(generic-package))
|