Daniel Rosser

Apply AFTER the OpenJPEG vendor patch #182 (CVE-2024-28574/28575/28576). From the FreeImage tree root: gzip -dc CVE-2024-28574.patch.gz | patch -p0 gzip -dc CVE-2024-28562.patch.gz | patch -p0 https://sourceforge.net/p/freeimage/patches/182/

OpenEXR vendor-tree replacement is now #183 (CVE-2024-28562/28563/28564/28569: OpenEXR 2.2 -> 3.3.13). Apply this ticket first: gzip -dc CVE-2024-28574.patch.gz | patch -p0 then the OpenEXR patch from #183: gzip -dc CVE-2024-28562.patch.gz | patch -p0 https://sourceforge.net/p/freeimage/patches/183/

Sorry this one is a bit huge hopefully patch works on it. added to gz compressed.

Vendor-tree replacement #1 of 2 (OpenJPEG 2.0.0 -> 2.5.4). OpenEXR 2.2 -> 3.3.13 follows in a few minutes so the tracker is not flooded. Apply this first: gzip -dc CVE-2024-28574.patch.gz | patch -p0

@drolon ARCH Linux has removed FreeImage due to CVE's Please apply these patches

Index of the SVN r1911 CVE patch series from danoli3/FreeImage (GitHub 3.19.14 + follow-ups). Apply from the FreeImage tree root with: patch -p0 < CVE-....patch Already on this tracker: 170 CVE-2020-24292 ICO LoadStandardIcon 171 CVE-2020-24293 psdThumbnail::Read 172 CVE-2020-24295 ReadImageLine 173 CVE-2020-22524 PFM integer overflow 174 (this ticket) CVE-2020-24294 / CVE-2024-28565 UnpackRLE 175 CVE-2024-28579 / CVE-2024-28582 HDR 176 CVE-2024-28584 J2K NULL 177 CVE-2024-28581 TARGA IOCache 178...

SVN-style unified diff against FreeImage trunk r1911 is attached (CVE-2020-22524, PluginPFM.cpp Load 32-bit 3*width overflow before malloc). This is the earlier GitHub fix: https://github.com/danoli3/FreeImage/commit/668385e / PR https://github.com/danoli3/FreeImage/pull/56 Siblings just posted for the 2020 ICO/PSD heap overflows: 170, 171, 172. Original ICO/PSD report: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/ Apply from the FreeImage tree root: patch -p0 < CVE-202...

SVN-style unified diff against FreeImage trunk r1911 is attached (CVE-2020-24295, psdParser::ReadImageLine destination writes). Same change: https://github.com/danoli3/FreeImage/pull/110 Siblings: 170 (ICO), 171 (thumbnail), 173 (PFM). Original report: https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/ Apply from the FreeImage tree root: patch -p0 < CVE-2020-24295.patch