UBUNTU-CVE-2022-1325

    Dashboard / Vulnerabilities / UBUNTU-CVE-2022-1325

    UBUNTU-CVE-2022-1325

    Published: 31 Aug 2022Last Modified: 22 Apr 2026
    Upstream:
    CVE-2022-1325
    Aliases:
    USN-7437-1

    Summary:

    Details: A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.

    References: https://ubuntu.com/security/CVE-2022-1325, https://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/, https://access.redhat.com/security/cve/CVE-2022-1325, https://bugzilla.redhat.com/show_bug.cgi?id=2074549, https://github.com/GreycLab/CImg/pull/348, https://www.cve.org/CVERecord?id=CVE-2022-1325, https://ubuntu.com/security/notices/USN-7437-1

    Affected packages

    Package

    Name: cimg

    Purl: pkg:deb/ubuntu/[email protected]+dfsg-1?arch=source&distro=xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.6.4+dfsg-1build1
    1.6.5+dfsg-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2022-1325 | CVE-DB