cbcvebase.
CVE-2019-12213
published 2019-05-20

CVE-2019-12213: When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaustion.

PriorityP428medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
2.20%
80.5th percentile
When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaustion.

Affected

18 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux——
debiandebian_linux——
debiandebian_linux——
debiandebian_linux——
debianfreeimage< freeimage 3.18.0+ds2-3 (bookworm)freeimage 3.18.0+ds2-3 (bookworm)
fedoraprojectfedora——
fedoraprojectfedora——
freeimage_projectfreeimage——
freeimage_projectfreeimage>= 0 < 3.18.0+ds2-33.18.0+ds2-3
freeimage_projectfreeimage>= 0 < 3.18.0+ds2-33.18.0+ds2-3
freeimage_projectfreeimage>= 0 < 3.18.0+ds2-33.18.0+ds2-3
freeimage_projectfreeimage>= 0 < 3.18.0+ds2-33.18.0+ds2-3
freeimage_projectfreeimage>= 0 < 3.17.0+ds1-5+deb9u1build0.18.04.13.17.0+ds1-5+deb9u1build0.18.04.1
freeimage_projectfreeimage>= 0 < 3.18.0+ds2-1ubuntu3.13.18.0+ds2-1ubuntu3.1
freeimage_projectfreeimage>= 0 < 3.18.0+ds2-6ubuntu5.13.18.0+ds2-6ubuntu5.1
freeimage_projectfreeimage>= 0 < 3.15.4-3ubuntu0.1+esm33.15.4-3ubuntu0.1+esm3
freeimage_projectfreeimage>= 0 < 3.17.0+ds1-2ubuntu0.1+esm13.17.0+ds1-2ubuntu0.1+esm1
freeimage_projectfreeimage>= 0 < 3.17.0+ds1-5+deb9u1ubuntu0.1~esm13.17.0+ds1-5+deb9u1ubuntu0.1~esm1

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.