#180 CVE-2024-28568/9029/28570/28573/28577/28578/28580: IPTC/Exif/XPM/RAS OOB
Applies to FreeImage SVN trunk r1911 (also 3.19.0 [r1909]).
One patch covering the issue #35 metadata/RAS/XPM group (GitHub PR #96 / commit d474400):
- CVE-2024-28568 / CVE-2024-9029 — read_iptc_profile() 1-byte over-read of profile[offset+1] when TAG_RECORD_VERSION has tagByteCount == 1 (Source/Metadata/IPTC.cpp)
- CVE-2024-28570 — processMakerNote() memcmp of camera signatures against a short tag (Source/Metadata/Exif.cpp). Every signature compare is now length-checked.
- CVE-2024-28573 — jpeg_read_exif_profile() did not require APP1 length to cover Exif\0\0 + 8-byte TIFF header
- CVE-2024-28577 — jpeg_read_exif_profile_raw() NULL/short-buffer deref before the 6-byte signature memcmp
- CVE-2024-28578 / CVE-2024-28580 — RAS Load()/ReadData() used WORD linelength/x/y so a wide image wrapped; 24/32bpp row mallocs had no overflow check (PluginRAS.cpp)
- XPM pixel-row length check (strlen(str) < width*cpp) — sibling of CVE-2024-28583; the XBM readLine() fix is in the follow-up patch
NVD:
https://nvd.nist.gov/vuln/detail/CVE-2024-28568
https://nvd.nist.gov/vuln/detail/CVE-2024-9029
https://nvd.nist.gov/vuln/detail/CVE-2024-28570
https://nvd.nist.gov/vuln/detail/CVE-2024-28573
https://nvd.nist.gov/vuln/detail/CVE-2024-28577
https://nvd.nist.gov/vuln/detail/CVE-2024-28578
https://nvd.nist.gov/vuln/detail/CVE-2024-28580
GitHub: https://github.com/danoli3/FreeImage/commit/d474400 (PR https://github.com/danoli3/FreeImage/pull/96)
Apply from the FreeImage tree root (after CVE-2021-33367.patch if you take that too):
patch -p0 < CVE-2024-28568.patch
Related
Discussion
Anonymous
