An issue was discovered in CImg v.220. A double free in load_bmp in CImg.h occurs when loading a crafted bmp image.
Weakness
The product calls free() twice on the same memory address.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cimg | Cimg | .220 (including) | .220 (including) |
| Cimg | Ubuntu | artful | * |
| Cimg | Ubuntu | bionic | * |
| Cimg | Ubuntu | cosmic | * |
| Cimg | Ubuntu | esm-apps/bionic | * |
| Cimg | Ubuntu | esm-apps/xenial | * |
| Cimg | Ubuntu | trusty | * |
| Cimg | Ubuntu | upstream | * |
| Cimg | Ubuntu | xenial | * |
Potential Mitigations
References
- https://github.com/dtschump/CImg/issues/184
- https://github.com/xiaoqx/pocs/tree/master/cimg
- https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
- https://usn.ubuntu.com/4039-1/
- https://github.com/dtschump/CImg/issues/184
- https://github.com/xiaoqx/pocs/tree/master/cimg
- https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
- https://usn.ubuntu.com/4039-1/