CVE-2022-1325

2022-08-3100:00:00

ubuntu.com

clmg

flaw

application vulnerability

buffer overflow

file parsing

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

46.8%

JSON

A flaw was found in Clmg, where with the help of a maliciously crafted
pandore or bmp file with modified dx and dy header field values it is
possible to trick the application into allocating huge buffer sizes like 64
Gigabyte upon reading the file from disk or from a virtual buffer.

Bugs

<https://github.com/GreycLab/CImg/issues/343>

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchcimg< anyUNKNOWN
ubuntu20.04noarchcimg< anyUNKNOWN
ubuntu22.04noarchcimg< anyUNKNOWN
ubuntu24.04noarchcimg< anyUNKNOWN
ubuntu16.04noarchcimg< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	cimg	< any	UNKNOWN
ubuntu	20.04	noarch	cimg	< any	UNKNOWN
ubuntu	22.04	noarch	cimg	< any	UNKNOWN
ubuntu	24.04	noarch	cimg	< any	UNKNOWN
ubuntu	16.04	noarch	cimg	< any	UNKNOWN