CVE-2022-1325 Denial of service in Clmg
Attackers can cause denial of service in Clmg by providing crafted image files that trigger excessive memory allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-1325?
CVE-2022-1325 is a medium-severity denial of service vulnerability in Clmg, published on 31 Aug 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
Which versions are affected by CVE-2022-1325?
It affects 1 product.
Products include Cimg Cimg.
How do I fix CVE-2022-1325?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-1325 being exploited?
There is no known exploitation of CVE-2022-1325 in the wild and no public exploit code.
Other vulnerabilities in Clmg
Sources
Also known as DEBIAN-CVE-2022-1325, GHSA-7vq8-69px-r6f8, UBUNTU-CVE-2022-1325.