mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-23 15:54:21 -09:00
4d2210dcfa
This package’s last release dates back to July 2018. Since then, a
number of CVEs have accumulated. This patch applies several
vulnerability fixes from the Fedora project. Not all vulnerabilities are
addressed by this patch.
- CVE-2019-12211
When FreeImage 3.18.0 reads a tiff file, it will be handed to the
Load function of the PluginTIFF.cpp file, but a memcpy occurs in
which the destination address and the size of the copied data are
not considered, resulting in a heap overflow.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2019-12211
- CVE-2019-12213
When FreeImage 3.18.0 reads a special TIFF file, the
TIFFReadDirectory function in PluginTIFF.cpp always returns 1,
leading to stack exhaustion.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2019-12213
- CVE-2020-24292
Buffer Overflow vulnerability in load function in PluginICO.cpp in
FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
code via opening of crafted ico file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2020-24292
- https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- CVE-2020-24293
Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp
in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
code via opening of crafted psd file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2020-24293
- https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- CVE-2020-24295
Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in
FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary
code via use of crafted psd file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2020-24295
- https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
- CVE-2021-33367
Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker
to cause a denial of service via a crafted JXR file.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-33367
- https://sourceforge.net/p/freeimage/discussion/36109/thread/1a4db03d58/
- CVE-2021-40263
A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad
function in PluginTIFF.cpp.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-40263
- https://sourceforge.net/p/freeimage/bugs/336/
- CVE-2021-40266
FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is
vulnerabile to null pointer dereference.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-40266
- https://sourceforge.net/p/freeimage/bugs/334/
- CVE-2023-47995
Memory Allocation with Excessive Size Value discovered in
BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0
allows attackers to cause a denial of service.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-47995
- CVE-2023-47997
An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in
FreeImage 3.18.0 leads to an infinite loop and allows attackers to
cause a denial of service.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-47997
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6750719a20)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at http://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches