CVE-2024-9029 Freeimage: heap buffer overflow in tiff_read_iptc_profile
A heap buffer over-read in FreeImage allows attackers to cause a denial of service via crafted images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9029?
CVE-2024-9029 is a high-severity memory corruption vulnerability in Freeimage Project Freeimage, published on 27 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the freeimage library. Processing a crafted image can cause a buffer over-read of 1 byte in the read_iptc_profile function in the Source/Metadata/IPTC.cpp file because the size of the profile is not being sanitized, causing a crash in the application linked to the library, resulting in a denial of service.
Weakness: CWE-126
Which versions are affected by CVE-2024-9029?
It affects 1 product.
Products include Freeimage Project Freeimage.
How do I fix CVE-2024-9029?
No fix has been published for CVE-2024-9029 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-9029 being exploited?
There is no known exploitation of CVE-2024-9029 in the wild and no public exploit code.
Other vulnerabilities in Freeimage Project Freeimage
Sources
Also known as DEBIAN-CVE-2024-9029, GHSA-fp55-3wc6-fhhx, UBUNTU-CVE-2024-9029.