Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-7554: sam2p may crash with malformed BMP image

CVE-2018-7554 · published 8 years ago

Summary

The sam2p image conversion tool can stop working if it receives a specially crafted BMP file. This causes the program to fail and stop, potentially interrupting services that rely on it. Update to a newer version of sam2p or avoid processing untrusted BMP images until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
sam2p_project	sam2p	0.49.4 `cpe:2.3:a:sam2p_project:sam2p:0.49.4:::::::*`
debian	debian_linux	7.0 `cpe:2.3:o:debian:debian_linux:7.0:::::::*`

Original advisory text

There is an invalid free in ReadImage in input-bmp.ci that leads to a Segmentation fault in sam2p 0.49.4. A crafted input will lead to a denial of service or possibly unspecified other impact.

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891527 Issue Tracking Third Party Advisory
https://github.com/pts/sam2p/issues/29 Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00004.html Mailing List Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

2% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published28 Feb 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-7554 · NVD

Track software like this

Free during beta