CVE-2024-28584

Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the J2KImageToFIBITMAP() function when reading images in J2K format.

Weakness

The product dereferences a pointer that it expects to be valid but is NULL.

Affected Software

Name	Vendor	Start Version	End Version
Freeimage	Freeimage_project	3.19.0 (including)	3.19.0 (including)
Freeimage	Ubuntu	focal	*
Freeimage	Ubuntu	mantic	*
Freeimage	Ubuntu	oracular	*
Freeimage	Ubuntu	trusty/esm	*

Potential Mitigations

References

http://www.openwall.com/lists/oss-security/2024/04/11/10
http://www.openwall.com/lists/oss-security/2024/04/11/2
http://www.openwall.com/lists/oss-security/2024/04/11/3
https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909
http://www.openwall.com/lists/oss-security/2024/04/11/10
http://www.openwall.com/lists/oss-security/2024/04/11/2
http://www.openwall.com/lists/oss-security/2024/04/11/3
https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909

NVD	https://nvd.nist.gov/vuln/detail/CVE-2024-28584
CWE	https://cwe.mitre.org/data/definitions/476.html

NULL Pointer Dereference

Weakness

Affected Software

Potential Mitigations

References