Security fix for CVE-2016-5684

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-68 (FreeImage: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in in FreeImage. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted       image file, could possibly execute arbitrary code with the privileges of       the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities were discovered in the FreeImage multimedia library, which might result in denial of service or the execution of arbitrary code if a malformed XMP or RAW image is processed.

This update for freeimage fixes one issues.

This security issue was fixed :

  - CVE-2016-5684: Prevent out-of-bounds write vulnerability     in the XMP image handling functionality. A specially     crafted XMP file could have caused an arbitrary memory     overwrite resulting in code execution (boo#1002621).

TALOS reports :

An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3925-1 advisory.

    It was discovered that an out-of-bounds write vulnerability existed in the XMP image handling     functionality of the FreeImage library. If a user or automated system were tricked into opening a     specially crafted image, a remote attacker could overwrite arbitrary memory, resulting in code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
94881	Fedora 25 : freeimage (2016-f55f5b10dc)	Nessus	Fedora Local Security Checks	11/15/2016	1/11/2021	high
96854	GLSA-201701-68 : FreeImage: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/30/2017	1/11/2021	high
94056	Debian DSA-3692-1 : freeimage - security update	Nessus	Debian Local Security Checks	10/14/2016	1/11/2021	high
94797	Fedora 25 : mingw-freeimage (2016-4247f42b66)	Nessus	Fedora Local Security Checks	11/15/2016	1/11/2021	high
94030	Fedora 24 : freeimage (2016-d07987265b)	Nessus	Fedora Local Security Checks	10/13/2016	1/11/2021	high
106551	openSUSE Security Update : freeimage (openSUSE-2018-121)	Nessus	SuSE Local Security Checks	2/1/2018	1/19/2021	high
94025	Fedora 24 : mingw-freeimage (2016-4529e034ca)	Nessus	Fedora Local Security Checks	10/13/2016	1/11/2021	high
109053	FreeBSD : freeimage -- code execution vulnerability (5b1631dc-eafd-11e6-9ac1-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	4/16/2018	11/4/2024	high
94026	Fedora 23 : freeimage (2016-5cbcad7a9a)	Nessus	Fedora Local Security Checks	10/13/2016	1/11/2021	high
94029	Fedora 23 : mingw-freeimage (2016-cca868c95f)	Nessus	Fedora Local Security Checks	10/13/2016	1/11/2021	high
123504	Ubuntu 14.04 LTS / 16.04 LTS : FreeImage vulnerability (USN-3925-1)	Nessus	Ubuntu Local Security Checks	3/29/2019	8/27/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high