CVE-2020-24292: 
Homebrew vulnerability analysis and mitigation

CVE-2020-24292 is a buffer overflow vulnerability discovered in the load function within PluginICO.cpp of FreeImage version 3.19.0 [r1859]. This security flaw allows remote attackers to execute arbitrary code by opening a specially crafted ICO file (NVD, MITRE).

The vulnerability occurs in the load function of PluginICO.cpp when the io->read_proc function is executed. The issue arises because the size calculation doesn't properly consider the 'height * pitch' parameters, leading to a heap buffer overflow condition. The CVSS v3.1 base score for this vulnerability is 8.8 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code on the affected system. The buffer overflow condition could potentially lead to memory corruption and system compromise when processing specially crafted ICO files (SourceForge).

Fedora has released security updates to address this vulnerability in their packages. Users can update using the dnf package manager with the command 'dnf upgrade --advisory FEDORA-2023-8e640cb540' for Fedora 39 and 'dnf upgrade --advisory FEDORA-2023-604a7d56b0' for Fedora 38 (Fedora Update).