Advisories ยป MGASA-2020-0019

Updated freeimage packages fix security vulnerabilities

Publication date: 05 Jan 2020
Modification date: 05 Jan 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-12211 , CVE-2019-12213

Description

The updated packages fix security vulnerabilities:

When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load
function of the PluginTIFF.cpp file, but a memcpy occurs in which the
destination address and the size of the copied data are not considered,
resulting in a heap overflow. (CVE-2019-12211)

When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory
function in PluginTIFF.cpp always returns 1, leading to stack exhaustion.
(CVE-2019-12213)

References

SRPMS

7/core