Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-1325: Clmg allocates huge buffer sizes with malicious BMP file
CVE-2022-1325 · published 4 years ago
Summary
A maliciously crafted image file can trick Clmg into allocating a large amount of memory, potentially leading to a denial-of-service or other issues. This vulnerability affects Clmg, which is used for image processing. To protect your system, update Clmg to the latest version or consider replacing it with a more secure alternative.
What to do
- Update debian cimg to version 3.1.6+dfsg-1.
- Update cimg cimg to version 3.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | cimg |
< 3.1.6+dfsg-1 Fix: upgrade to 3.1.6+dfsg-1
|
| Debian:13 | debian | cimg |
< 3.1.6+dfsg-1 Fix: upgrade to 3.1.6+dfsg-1
|
| Debian:14 | debian | cimg |
< 3.1.6+dfsg-1 Fix: upgrade to 3.1.6+dfsg-1
|
| – | cimg | cimg |
< 3.1.0 cpe:2.3:a:cimg:cimg:*:*:*:*:*:*:*:* |
Original advisory text
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge b...
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
References
- https://security-tracker.debian.org/tracker/CVE-2022-1325 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1325.j... Vendor Advisory
- https://github.com/GreycLab/CImg/pull/348 Patch
- https://nvd.nist.gov/vuln/detail/CVE-2022-1325 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-1325 URL
- https://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/ URL
- https://bugzilla.redhat.com/show_bug.cgi?id=2074549 Third Party Advisory
- https://github.com/GreycLab/CImg/issues/343 Third Party Advisory
- https://github.com/GreycLab/CImg/commit/619cb58dd90b4e03ac68286c70ed98acbefd1c90 Patch
Severity
5.5
Medium
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published31 Aug 2022
Updated4 Nov 2026
First seen9 Jul 2026
Track software like this
Free during beta