1. Ubuntu Security Notices
  2. USN-3925-1

USN-3925-1: FreeImage vulnerability

Publication date

28 March 2019

Overview

FreeImage could be made to crash or run programs as your login if it opened a specially crafted file.

Releases

Packages

  • freeimage - Support library for graphics image formats (development files)

Details

It was discovered that an out-of-bounds write vulnerability existed in the XMP
image handling functionality of the FreeImage library. If a user or automated
system were tricked into opening a specially crafted image, a remote attacker
could overwrite arbitrary memory, resulting in code execution.

It was discovered that an out-of-bounds write vulnerability existed in the XMP
image handling functionality of the FreeImage library. If a user or automated
system were tricked into opening a specially crafted image, a remote attacker
could overwrite arbitrary memory, resulting in code execution.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
16.04 xenial libfreeimage3 –  3.17.0+ds1-2ubuntu0.1
libfreeimageplus3 –  3.17.0+ds1-2ubuntu0.1
14.04 trusty libfreeimage3 –  3.15.4-3ubuntu0.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›