Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-41484: A flaw of memory leak · Issue #49 · eddieantonio/imgcat

An issue in cimg.eu Cimg Library v2.9.3 allows an attacker to obtain sensitive information via a crafted JPEG file.

CVE

this bug was found with afl.

proof:

=================================================================
==26325==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 7499 byte(s) in 1 object(s) allocated from:
#0 0x7f7716c54cef in operator new[](unsigned long) …/…/…/…/libsanitizer/asan/asan_new_delete.cc:107
#1 0x54f41b in cimg_library::CImg::CImg(unsigned int, unsigned int, unsigned int, unsigned int) CImg/CImg.h:11793
#2 0x54f41b in cimg_library::CImg::_load_jpeg(_IO_FILE*, char const*) CImg/CImg.h:51847
#3 0x58272f in cimg_library::CImg::load_jpeg(char const*) CImg/CImg.h:51771
#4 0x58272f in cimg_library::CImg::load(char const*) CImg/CImg.h:51419
#5 0x41d800 in cimg_library::CImg::assign(char const*) CImg/CImg.h:12578
#6 0x41d800 in load_image src/load_image.cc:49
#7 0x40f7e3 in print_iterate src/print_image.c:95
#8 0x40f7e3 in print_image src/print_image.c:77

SUMMARY: AddressSanitizer: 7499 byte(s) leaked in 1 allocation(s).

[NAME OF AFFECTED PRODUCT(S) AND VERSION(S)]
CImg v2.9.3

[PROBLEM TYPE]
memory leak, cause program crash.

[DESCRIPTION]
The problem arises when using the CImg::load_jpeg function

jpeg sample file:

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda