p PatchFirst

CVE-2022-1325

CVE-2022-1325

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.

CVSS 5.5 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • clmg

    Versions
    • Fixed in v3.1.0: Affected

    No fix published

  • cimg Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.1.6+dfsg-1

    Update to 3.1.6+dfsg-1

  • cimg Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.1.6+dfsg-1

    Update to 3.1.6+dfsg-1

  • cimg Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.1.6+dfsg-1

    Update to 3.1.6+dfsg-1

  • cimg Ubuntu:16.04:LTS

    Versions
    • 1.6.4+dfsg-1build1
    • 1.6.5+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cimg Ubuntu:Pro:18.04:LTS

    Versions
    • 1.7.9+dfsg-2
    • 1.7.9+dfsg-2build1
    • 1.7.9+dfsg-2ubuntu0.18.04.1
    • 1.7.9+dfsg-2ubuntu0.18.04.2
    • 1.7.9+dfsg-2ubuntu0.18.04.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cimg Ubuntu:20.04:LTS

    Versions
    • 2.4.5+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cimg Ubuntu:Pro:22.04:LTS

    Versions
    • 2.9.4+dfsg-2
    • 2.9.4+dfsg-3
    Affected ranges
    • ECOSYSTEM: < 2.9.4+dfsg-3ubuntu0.1~esm1

    Update to 2.9.4+dfsg-3ubuntu0.1~esm1

Original sources

Check your server →