CVE-2016-5684
Publication date 6 January 2017
Last updated 25 August 2025
Ubuntu priority
Description
An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library. A specially crafted XMP file can cause an arbitrary memory overwrite resulting in code execution. An attacker can provide a malicious image to trigger this vulnerability.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| freeimage | ||
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Fixed 3.17.0+ds1-2ubuntu0.1
|
|
| 14.04 LTS trusty |
Fixed 3.15.4-3ubuntu0.1
|
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.8 · High
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-3925-1
- FreeImage vulnerability
- 28 March 2019
Other references
- http://www.talosintelligence.com/reports/TALOS-2016-0189/
- http://freeimage.cvs.sourceforge.net/viewvc/freeimage/FreeImage/Source/FreeImage/PluginXPM.cpp?r1=1.17&r2=1.18
- http://freeimage.cvs.sourceforge.net/viewvc/freeimage/FreeImage/Source/FreeImage/PluginXPM.cpp?r1=1.18&r2=1.19
- https://www.cve.org/CVERecord?id=CVE-2016-5684