CVE-2024-31570 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 52%

Affected Products (NVD)

Vendor	Product	Version
freeimage_project	freeimage	3.4.0 ≤ 𝑥 ≤ 3.18.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

freeimage

bookworm	no-dsa
bookworm (security)	vulnerable
bullseye	postponed
bullseye (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

freeimage

bionic	deferred
focal	deferred
jammy	deferred
mantic	ignored
noble	deferred
oracular	ignored
plucky	deferred
questing	deferred
trusty	deferred
xenial	deferred

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.
CWE-121 - Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References

https://sourceforge.net/p/freeimage/bugs/355/

https://www.openwall.com/lists/oss-security/2024/04/11/10