Every CVE Search/ Get API key

CVE-2023-47995

Buffer Overflow vulnerability in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0...

6.5 MediumFix available

Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.73%Up 0.7 points since Jan 17, 2024
90%50%10%1%

What each source reports

NVD Score used 6.5

Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.

Record
CVE-2023-47995
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
CVE List 6.5

Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.

Record
CVE-2023-47995
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2023-52084 6.5

Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.

Record
EUVD-2023-52084
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6jfr-j7mc-g8fg 6.5

Buffer Overflow vulnerability in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0...

Buffer Overflow vulnerability in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.

Record
GHSA-6jfr-j7mc-g8fg
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
OSV 6.5

Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.

Record
CVE-2023-47995
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-47995 6.5

Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.

Record
DEBIAN-CVE-2023-47995
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-2305 8.8

freeimage security update

FreeImage is a library project for developers who would like to support popular graphics image formats (PNG, JPEG, TIFF, BMP and others). Some highlights are: extremely simple in use, not limited to the local PC (unique FreeImageIO) and Plugin driven!

Security Fix(es):

Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted ico file.(CVE-2020-24292)

Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code via opening of crafted psd file.(CVE-2020-24293)

Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary code via use of crafted psd file.(CVE-2020-24295)

Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker to cause a denial of service via a crafted JXR file.(CVE-2021-33367)

A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp.(CVE-2021-40263)

FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is vulnerabile to null pointer dereference.(CVE-2021-40266)

Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.(CVE-2023-47995)

An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of service.(CVE-2023-47997)

Record
OESA-2024-2305
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-47995 6.5

Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of service.

Record
UBUNTU-CVE-2023-47995
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2024-0087 No score

Updated freeimage packages fix security vulnerabilities

Buffer Overflow vulnerability in FreeImage_AllocateBitmap. (CVE-2023-47995) Infinite loop exits in Load in PluginTIFF.cpp. (CVE-2023-47997)

Record
MGASA-2024-0087
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freeimage
Debian:12
 All versions, plus listed versions
3.18.0+ds2-103.18.0+ds2-113.18.0+ds2-93.18.0+ds2-9+deb12u13.18.0+ds2-9.14.2.1+ds-1~exp14.2.1+ds-1~exp24.2.1+ds-1~exp3
 None known
freeimage
Debian:13
 All versions, plus listed versions
3.18.0+ds2-114.2.1+ds-1~exp14.2.1+ds-1~exp24.2.1+ds-1~exp3
 None known
freeimage
Mageia:9
 before 3.18.0-10.1.mga9
3.18.0-10.1.mga9
freeimage
openEuler:20.03-LTS-SP4
 before 3.18.0-7.oe2003sp4
3.18.0-7.oe2003sp4
freeimage
openEuler:22.03-LTS-SP1
 before 3.18.0-11.oe2203sp1
3.18.0-11.oe2203sp1
freeimage
openEuler:24.03-LTS
 before 3.18.0-13.oe2403
3.18.0-13.oe2403
freeimage
openEuler:22.03-LTS-SP4
 before 3.18.0-11.oe2203sp4
3.18.0-11.oe2203sp4
freeimage
openEuler:22.03-LTS-SP3
 before 3.18.0-11.oe2203sp3
3.18.0-11.oe2203sp3
freeimage
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.15.1-2build13.15.1-2build23.15.4-23.15.4-33.15.4-3ubuntu0.13.15.4-3ubuntu0.1+esm13.15.4-3ubuntu0.1+esm23.15.4-3ubuntu0.1+esm3
 None known
freeimage
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.15.4-4.1build13.15.4-63.17.0+ds1-1.13.17.0+ds1-23.17.0+ds1-2ubuntu0.13.17.0+ds1-2ubuntu0.1+esm1
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
freeimage
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.17.0+ds1-5build23.17.0+ds1-5+deb9u1build0.18.04.13.17.0+ds1-5+deb9u1ubuntu0.1~esm1
 None known
freeimage
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.18.0+ds2-1ubuntu13.18.0+ds2-1ubuntu23.18.0+ds2-1ubuntu33.18.0+ds2-1ubuntu3.1
 None known
freeimage
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.18.0+ds2-6ubuntu33.18.0+ds2-6ubuntu43.18.0+ds2-6ubuntu53.18.0+ds2-6ubuntu5.1
 None known
freeimage
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.18.0+ds2-9.13.18.0+ds2-103.18.0+ds2-10build23.18.0+ds2-10build33.18.0+ds2-10build4
 None known
freeimage
Ubuntu:25.10
 All versions, plus listed versions
3.18.0+ds2-11
 None known
freeimage
Ubuntu:26.10
 All versions, plus listed versions
3.18.0+ds2-11build13.18.0+ds2-11build23.18.0+ds2-11build3
 None known
freeimage
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.18.0+ds2-113.18.0+ds2-11build1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-47995 is a medium vulnerability (CVSS 6.5) in Freeimage Project Freeimage, published January 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in freeimage 3.18.0-10.1.mga9.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open