CVE-2024-28577: Null Pointer Dereference

Published Mar 20, 2024

Updated

Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the jpegreadexifprofileraw() function when reading images in JPEG format.

Affected Software

2 affected components

Freeimage Project Freeimage=3.19.0

FreeImage FreeImage

Event History

Mar 20, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-28577?

CVE-2024-28577 has a high severity as it allows local attackers to trigger a denial of service (DoS).

How do I fix CVE-2024-28577?

To remediate CVE-2024-28577, update to the latest version of FreeImage that includes security patches addressing this vulnerability.

What is the impact of CVE-2024-28577?

The impact of CVE-2024-28577 is that it can cause a denial of service condition when processing JPEG images, potentially crashing applications using FreeImage.

Who is affected by CVE-2024-28577?

CVE-2024-28577 affects users and applications utilizing FreeImage v.3.19.0 [r1909] for processing JPEG images.

How does CVE-2024-28577 exploit the system?

CVE-2024-28577 exploits the system through a null pointer dereference in the jpeg_read_exif_profile_raw() function, leading to crashes.