Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Urgent security issue] FreeImage arbitrary code execution vulnerability #437

Open
lavenderdotpet opened this issue Mar 31, 2024 · 1 comment

Comments

@lavenderdotpet
Copy link

main 2 I think is the most important to point out

both of these can run arbitrary code one of them being from the BMP plugin
so I am assuming a person could get a user to load a malicious BMP or a file with a malicious bpm inside of it

Free Image should either be forked and fixed asap or abandoned for a different library

active project i could find that use freeimage
https://github.com/sirjuddington/SLADE
https://github.com/TrenchBroom/TrenchBroom
https://github.com/RetroPie/EmulationStation
https://github.com/MonoGame/MonoGame
https://github.com/meganz/MEGAsync
https://github.com/OGRECave/ogre
https://github.com/OGRECave/ogre-next
https://github.com/Open-Cascade-SAS/OCCT
https://github.com/arrayfire/forge
https://git.sr.ht/~exec64/imv
https://github.com/arrayfire/arrayfire

Free Image v3.18.0

Free Image before v1.18.0

@darksylinc
Copy link
Member

Thanks for reporting this issue.

We've recently moved to FreeImageRe by default to address the issue of FreeImage being stale for years and unaddressed vulnerabilities.

Fortunately most use-cases (but not all of them) of OgreNext involve only loading images from trusted sources; but nonetheless they should be addressed.

If I read correctly CVE-2023-47994 & CVE-2023-47992 do not propose a fix or patch?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants