{"id":"CVE-2024-53901","aliases":["DEBIAN-CVE-2024-53901","EUVD-2024-52180","GHSA-cwgj-pq49-6x66","MGASA-2026-0284","UBUNTU-CVE-2024-53901"],"status":"published","title":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of...","description":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00386,"percentile":0.33096,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-787"],"published":"2024-11-24T00:00:00Z","modified":"2026-11-09T12:49:26Z","fixes":[{"ecosystem":"Debian:13","package":"libimager-perl","fixed_in":["1.025+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libimager-perl","fixed_in":["1.025+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.019+dfsg-1","1.019+dfsg-2","1.020+dfsg-1","1.022+dfsg-1","1.023+dfsg-1","1.024+dfsg-1","1.024+dfsg-2","1.025+dfsg-1","1.027+dfsg-1","1.028+dfsg-1","1.029+dfsg-1","1.030+dfsg-1","1.031+dfsg-1","1.032+dfsg-1","1.033+dfsg-1","1.034+dfsg-1","1.034+dfsg-2","1.035+dfsg-1","1.036+dfsg-1","1.037+dfsg-1","1.037+dfsg-2","1.040+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.025+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.025+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Imager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Imager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-2.2.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.011+dfsg-1","1.011+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libimager-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.019+dfsg-2","1.020+dfsg-1","1.022+dfsg-1","1.023+dfsg-1","1.023+dfsg-1build1","1.023+dfsg-1build2"]}],"products":[{"vendor":"tonycoz","product":"imager"}],"references":[{"url":"https://github.com/tonycoz/imager/issues/534","tags":["Exploit","Issue Tracking","report"]},{"url":"https://metacpan.org/release/TONYC/Imager-1.025/changes","tags":["Release Notes","web","report"]},{"url":"https://github.com/briandfoy/cpan-security-advisory/issues/171","tags":["Issue Tracking","report"]},{"url":"https://github.com/briandfoy/cpan-security-advisory/issues/167","tags":["Issue Tracking","Patch","report","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53901","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cwgj-pq49-6x66"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53901.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-53901","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0284.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35848","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QJU7MFFAP73YEH5YEG35EDMGSNOZ3O5/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/08/6","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41572386/","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41637674/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-53901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53901","tags":["report"]},{"url":"https://github.com/tonycoz/imager/commit/7851737838aa86113b276aea02729cc1f6e9eed0","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-53901","description":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.","status":"published","published":"2024-11-24T00:00:00Z","modified":"2024-11-24T18:19:31.792Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:34:17.523201Z"}],"euvd":[{"id":"EUVD-2024-52180","description":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.","status":"published","published":"2024-11-24T00:00:00Z","modified":"2024-11-24T18:19:31Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:49.727757Z"}],"ghsa":[{"id":"GHSA-cwgj-pq49-6x66","title":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of...","description":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.","status":"published","published":"2024-11-24T18:31:39Z","modified":"2024-11-26T21:32:24Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T14:58:58.204916Z"}],"nvd":[{"id":"CVE-2024-53901","description":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.","status":"published","published":"2024-11-24T17:15:04.99Z","modified":"2026-06-17T08:09:28.55Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787","CWE-120"],"updated_at":"2026-11-02T14:10:38.347238Z"}],"osv":[{"id":"CVE-2024-53901","description":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.","status":"published","published":"2024-11-24T00:00:00Z","modified":"2026-10-28T02:30:35.486314056Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"DEBIAN-CVE-2024-53901","description":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.","status":"published","published":"2024-11-24T17:15:04.99Z","modified":"2026-11-02T12:03:15.594348381Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:44.429177Z"},{"id":"UBUNTU-CVE-2024-53901","description":"The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.","status":"published","published":"2024-11-24T17:15:00Z","modified":"2026-11-09T12:49:26.684926754Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"MGASA-2026-0284","title":"Updated perl-Imager package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nThe Imager package before 1.025 for Perl has a heap-based buffer\noverflow leading to denial of service, or possibly unspecified other\nimpact, when the trim() method is called on a crafted input image.\n(CVE-2024-53901)\nImager versions before 1.032 for Perl have a heap out-of-bounds read in\nthe bundled Imager::File::SGI reader via a 16-bit RLE literal run in\nread_rgb_16_rle. (CVE-2026-13705)\nImager::File::JPEG versions before 1.003 for Perl leak heap memory when\nreading a JPEG with repeated APP13 markers in i_readjpeg_wiol.\n(CVE-2026-13708)\nImager versions before 1.033 for Perl treat unsigned EXIF IFD entry\ncounts as signed. (CVE-2026-14454)\n","status":"published","published":"2026-07-20T19:06:32Z","modified":"2026-07-20T19:15:05.272142173Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}