======================================================================== CVE-2022-4988                                        CPAN Security Group ========================================================================

CVE ID:  CVE-2022-4988   Distribution:  Alien-FreeImage       Versions:  through 1.001

MetaCPAN:  https://metacpan.org/dist/Alien-FreeImage       VCS Repo:  https://github.com/kmx/alien-freeimage

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries

Description ----------- Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries.

Alien::FreeImage contains version 3.17.0 of the FreeImage library from 2017, which has known vulnerabilities such as CVE-2015-0852 and CVE-2025-65803.  The library embeds other images libraries that also have known vulnerabilities.

Problem types ------------- - CWE-1395 Dependency on Vulnerable Third-Party Component

Workarounds ----------- The latest version of the FreeImage library is 3.18.0 from 2018, which also appears to have serious vulnerabilities.

Users are advised to use alternatives.

References ---------- https://freeimage.sourceforge.io/ https://metacpan.org/release/KMX/Alien-FreeImage-1.001/source/src/Source https://nvd.nist.gov/vuln/detail/CVE-2015-0852 https://nvd.nist.gov/vuln/detail/CVE-2025-65803 https://github.com/kmx/alien-freeimage/issues/4 https://github.com/kmx/alien-freeimage/issues/5

Timeline -------- - 2017-07-11: Alien::FreeImage released with FreeImage 3.17.0 - 2022-06-29: Issues added to git repository regarding security   vulnerabilities - 2022-06-29: Several issues added to CPANSA::DB - 2026-03-27: Issues logged with CPANSec

FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().

An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted PSD file.