Executive brief
Alien::FreeImage, a Perl tool used to install and provide the FreeImage graphics library, contains outdated and vulnerable components. These components are used by applications to process various image formats like PNG, JPEG, and TIFF. Because the library includes old versions of software with known security flaws, an attacker could potentially cause system crashes or gain unauthorized access by providing specially crafted image files.
Technical details
Alien::FreeImage through version 1.001 bundles FreeImage v3.17.0, which is affected by multiple security flaws including integer underflows in PluginPCX.cpp and integer overflows in psdParser::ReadImageData. Additionally, it embeds vulnerable versions of third-party libraries such as zlib (affected by CVE-2018-25032). These vulnerabilities can be triggered by remote, unauthenticated attackers providing maliciously crafted image files (e.g., PCX or PSD formats), leading to heap memory corruption and Denial of Service (DoS). The issue stems from the project's reliance on a static, outdated upstream source from 2017 that has not incorporated modern security patches.
Affected products
- KMX Alien::FreeImage through 1.001
Timeline
- 2022-06-29: other: Vulnerabilities in embedded libraries reported to maintainer via GitHub issues
- 2026-05-11: disclosed: CVE-2022-4988 published by CPANSec