VulnerabilityModified

CVE-2022-1325

A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from…

MEDIUM 5.5EPSS 0.42%

Does this matter?

Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 0.42% probability · 35th percentile
CISA KEV: Not listed
Weakness: CWE-400, CWE-770
Affected: cimg/cimg
Source: secalert@redhat.com

References

https://access.redhat.com/security/cve/CVE-2022-1325Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=2074549Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/GreycLab/CImg/commit/619cb58dd90b4e03ac68286c70ed98acbefd1c90Patch, Third Party Advisory
https://github.com/GreycLab/CImg/issues/343Exploit, Issue Tracking, Third Party Advisory
https://github.com/GreycLab/CImg/pull/348Patch, Third Party Advisory
https://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/Exploit, Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-1325Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=2074549Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/GreycLab/CImg/commit/619cb58dd90b4e03ac68286c70ed98acbefd1c90Patch, Third Party Advisory
https://github.com/GreycLab/CImg/issues/343Exploit, Issue Tracking, Third Party Advisory
https://github.com/GreycLab/CImg/pull/348Patch, Third Party Advisory
https://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.