Cloud Vulnerability DB
A community-led vulnerabilities database
Register for the AI for Security Summit: Join Figma, Perplexity & Wiz
Vulnerability DatabaseCVE-2024-28575
CVE-2024-28575:
Homebrew vulnerability analysis and mitigation
Overview
A Buffer Overflow vulnerability has been identified in open source FreeImage version 3.19.0 [r1909]. The vulnerability affects the opj_j2k_read_mct() function when processing images in J2K format (NVD). This security flaw was disclosed on March 20, 2024, and has been assigned the identifier CVE-2024-28575.
Technical details
The vulnerability exists in the opj_j2k_read_mct() function of FreeImage v.3.19.0 [r1909] when reading images in J2K format. According to the CVSS 3.1 scoring, it has received a Base Score of 6.2 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The weakness has been classified as CWE-121 (Stack-based Buffer Overflow) (NVD).
Impact
When successfully exploited, this vulnerability allows a local attacker to cause a denial of service (DoS) condition in the affected system. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (NVD).
Exploitability
The vulnerability requires local access to the system for exploitation. The attack complexity is considered low, requiring no privileges or user interaction to execute (NVD).
Mitigation and workarounds
As of January 16, 2025, no patch is available for this vulnerability. Ubuntu has marked this vulnerability as 'fix deferred' across multiple versions including 24.04 LTS, 22.04 LTS, 20.04 LTS, and others (Ubuntu).
Additional resources
Linux Distribution fix status
Fix availability across major Linux distributions and their releases.
Source: This report was generated using AI
Related Homebrew vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management