CVE-2015-0852
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote...
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
Exploit likelihood
What each source reports
NVD Score used
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
- Record
CVE-2015-0852- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
- Record
CVE-2015-0852- Updated
- 2026-11-02
EUVDEUVD-2015-0863 No score
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
- Record
EUVD-2015-0863- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vg9f-qf95-c67j No score
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote...
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
- Record
GHSA-vg9f-qf95-c67j- Updated
- 2026-11-02
OSV No score
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
- Record
CVE-2015-0852- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-0852 No score
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
- Record
DEBIAN-CVE-2015-0852- Updated
- 2026-11-02
OSVMGASA-2015-0339 No score
Updated freeimage packages fix security vulnerabilities
Updated freeimage packages fix security vulnerability:
FreeImage is vulnerable to an integer overflow in PluginPCX.cpp, making the PCX loader vulnerable to malicious images with a bad window specification (CVE-2015-0852).
Moreover, FreeImage was built in Mageia against a number of bundled libraries with potential security vulnerabilities. Most of those dependencies were unbundled to use the up-to-date system libraries, while the bundled libtiff was updated to a more recent version.
- Record
MGASA-2015-0339- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10485-1 No score
freeimage-devel-3.17.0-3.3 on GA media
These are all security issues fixed in the freeimage-devel-3.17.0-3.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10485-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-0852 No score
Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.
- Record
UBUNTU-CVE-2015-0852- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freeimageDebian:12 |
before 3.15.4-5 | 3.15.4-5 |
freeimageDebian:13 |
before 3.15.4-5 | 3.15.4-5 |
freeimageDebian:6.0 |
before 3.10.0-4+deb6u1, plus listed versions 3.10.0-4 |
3.10.0-4+deb6u1 |
freeimageDebian:7 |
before 3.15.1-1.1, plus listed versions 3.15.1-1 |
3.15.1-1.1 |
freeimageDebian:8 |
before 3.15.4-4.2, plus listed versions 3.15.4-4.1 |
3.15.4-4.2 |
freeimageMageia:4 |
before 3.154-1.1.mga4 | 3.154-1.1.mga4 |
freeimageMageia:5 |
before 3.154-1.1.mga5 | 3.154-1.1.mga5 |
freeimageUbuntu:Pro:14.04:LTS |
before 3.15.4-3ubuntu0.1+esm1, plus listed versions 3.15.1-2build13.15.1-2build23.15.4-23.15.4-33.15.4-3ubuntu0.1 |
3.15.4-3ubuntu0.1+esm1 |
freeimageopenSUSE:Tumbleweed |
before 3.17.0-3.3 | 3.17.0-3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0852 is a medium vulnerability (CVSS 5.0) in Freeimage Project Freeimage, published September 8, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.03%, the 87th percentile. Fixed in freeimage 3.15.4-5.
References
securitytracker.com/id/1034077
lists.fedoraproject.org/pipermail/package-announce/2015-October/168000.html
oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
debian.org/security/2015/dsa-3392
Show 16 moreShow less
openwall.com/lists/oss-security/2015/08/28/1
bugs.debian.org/cgi-bin/bugreport.cgi?bug=797165
security.gentoo.org/glsa/201701-68
nvd.nist.gov/vuln/detail/CVE-2015-0852
github.com/advisories/GHSA-vg9f-qf95-c67j
security-tracker.debian.org/tracker/CVE-2015-0852
advisories.mageia.org/MGASA-2015-0339.html
bugs.mageia.org/show_bug.cgi?id=16662
ubuntu.com/security/CVE-2015-0852
marc.info?l=oss-security&m=144073280200732&w=2
freeimage.cvs.sourceforge.net/viewvc/freeimage/FreeImage/Source/FreeImage/PluginPCX.cpp?r1=1.17&r2=1.18&pathrev=MAIN
cve.org/CVERecord?id=CVE-2015-0852
suse.com/security/cve/CVE-2015-0852