USN-4039-1: CImg vulnerabilities
First published: Wed Jun 26 2019(Updated: )
It was discovered that allocation failures could occur in CImg when loading crafted bmp images. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-7587) It was discovered that a heap-based buffer over-read existed in CImg when loading crafted bmp images. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-7588) It was discovered that a double free existed in CImg when loading crafted bmp images. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-7589)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/cimg-dev | <1.7.9+dfsg-2ubuntu0.18.10.1 | 1.7.9+dfsg-2ubuntu0.18.10.1 |
| =18.10 | ||
| All of | ||
| ubuntu/cimg-dev | <1.7.9+dfsg-2ubuntu0.18.04.1 | 1.7.9+dfsg-2ubuntu0.18.04.1 |
| =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2018-7587
- https://ubuntu.com/security/CVE-2018-7588
- https://ubuntu.com/security/CVE-2018-7589
- https://launchpad.net/ubuntu/+source/cimg/1.7.9+dfsg-2ubuntu0.18.10.1
- https://launchpad.net/ubuntu/+source/cimg/1.7.9+dfsg-2ubuntu0.18.04.1
- https://ubuntu.com/security/notices/USN-4039-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What is the severity of USN-4039-1?
The severity of USN-4039-1 is not specified.
What is the vulnerability in CImg that USN-4039-1 addresses?
USN-4039-1 addresses two vulnerabilities in CImg: CVE-2018-7587 and CVE-2018-7588.
How can an attacker exploit the vulnerabilities in CImg?
An attacker can exploit the vulnerabilities in CImg by loading crafted bmp images, which can lead to allocation failures or a heap-based buffer over-read.
What is the remedy for the vulnerabilities in CImg?
The remedy for the vulnerabilities in CImg is to update to version 1.7.9+dfsg-2ubuntu0.18.10.1 for Ubuntu 18.10 or version 1.7.9+dfsg-2ubuntu0.18.04.1 for Ubuntu 18.04.
Are there any known instances of these vulnerabilities being exploited?
There are no known instances of these vulnerabilities being exploited.
- agent/severity
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/title
- agent/weakness
- agent/tags
- agent/description
- agent/event
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/trending
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/18.10
- version/ubuntu ubuntu/18.04