Vulnerability · Published Aug 31, 2022 · Assigned by redhat
CVE-2022-1325
Medium 5.5
In plain English
A medium-severity uncontrolled resource consumption in Clmg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.4%top 63.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cimg | 3.1.6+dfsg-1 | DEBIAN-CVE-2022-1325 |
| Debian:13 | cimg | 3.1.6+dfsg-1 | DEBIAN-CVE-2022-1325 |
| Debian:14 | cimg | 3.1.6+dfsg-1 | DEBIAN-CVE-2022-1325 |
Affected products (as reported)
Weakness: CWE-400
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2074549 x_refsource_MISC
- https://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/ x_refsource_MISC
- https://github.com/GreycLab/CImg/issues/343 x_refsource_MISC
- https://github.com/GreycLab/CImg/pull/348 x_refsource_MISC
- https://github.com/GreycLab/CImg/commit/619cb58dd90b4e03ac68286c70ed98acbefd1c90 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2022-1325 x_refsource_MISC