MGASA-2026-0567: Updated cfitsio package fixes security vulnerabilities
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compressed image, read through fitsopenfile() and fitsreadpix(), to cause crashes or leak heap contents in decoded pixels.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/cfitsioto a version that resolves this vulnerability.Fixed in 4.7.0-1.mga10
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using CFITSIO to open and read pixel data from untrusted FITS files are exposed, specifically when processing SUBTRACTIVE_DITHER_1 compressed images.
What does an attacker need to exploit it?
An attacker needs to provide a crafted FITS file containing a SUBTRACTIVE_DITHER_1 compressed image with a zero or negative ZDITHER0 seed, and have the target process it through fits_open_file() and fits_read_pix().
What could successful exploitation cause?
The issue can cause a crash or disclose heap memory contents through decoded pixel values.