Re: Re: CWE-121, CWE-122: libfreeimage 3.40-3.18/19+ buffer overflow

[Michael Knap <oss-sec () mknap com>]

On Thursday, April 11th, 2024 at 10:02 AM, Michael Knap <oss-sec () mknap com> wrote:

>

>

>

>

> -------- Original Message --------
> On 11/04/2024 09:22, Tianyu Chen wrote:

> > Hi Michael,
> > I believe there may be a duplicate report for freeimage that you should be aware of. You can find it at the 
> > following link:

> > https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909

> > The linked report includes CVE-2024-28562, CVE-2024-28563, CVE-2024-28564, CVE-2024-28565, and more up to 
> > CVE-2024-28584.

> > Best regards,
> > Tianyu Chen

>

> Hi Tianyu,

> Indeed, it seems so! I apologize for any inconvenience this may have caused.

> I conducted a search on MITRE for the library and found several current CVEs,
> but I did not come across this specific report. Given that they are fairly recent,
> there might have been a period during which they were not yet visible in public searches.

> Thank you for bringing this to my attention!

> Best regards,
> Michael Knap

I have reviewed the CVE range mentioned by Tianyu, and it appears the XPM buffer overflow
hasn't been assigned. The repository Tianyu linked does indeed include the sprintf buffer
overflow vulnerability in the XPM parser. 


'''
### Vulnerability 22
Vulnerability Type: buffer overflow
Impact:             command execution
Affected component: PluginXPM.cpp, Load()

Description:        In FreeImage library version 3.19.0 [r1909], when reading images in XPM format,
                    the Load() function has a stack overflow write vulnerability, which may lead to 

                    a command execution.

Trace:
case10231: [WRITE,stack-buffer-overflow]@main->FreeImage_Load->FreeImage_LoadFromHandle->Load->sprintf
'''

The CVE has just now been assigned and credited to me, 

but it seems it should have been assigned along with the others in that repository.
Not sure what caused the issue and why it wasn't originally assigned with the others,
reported by Ruanxingzhi. I will contact MITRE with clarification and request to change the credit. 

The assigned CVE: CVE-2024-31570.

Best regards, 

Michael Knap

Attachment: publickey - oss-sec@mknap.com - 0xDF4CFAF0.asc
Description:

Attachment: signature.asc
Description: OpenPGP digital signature