CVE catalog

CVE-2019-12212

freeimage: CVE-2019-12212

Severity: Medium
Published: May 20, 2019, 4:29:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.90% · Oct 25, 2026

When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file, eventually causing stack exhaustion. An attacker can achieve a remote denial of service attack by sending a specially constructed file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	freeimage	sid	`3.18.0+ds2-11`	vulnerable
Debian	freeimage	trixie	`3.18.0+ds2-11`	vulnerable
Debian	freeimage	bookworm	`3.18.0+ds2-9+deb12u1`	vulnerable
Debian	freeimage	bookworm-security	`3.18.0+ds2-9+deb12u1`	vulnerable
Ubuntu	freeimage	pro	`3.17.0+ds1-5build2`	vulnerable
Ubuntu	freeimage	pro	`3.17.0+ds1-5+deb9u1build0.18.04.1`	vulnerable
Ubuntu	freeimage	pro	`3.17.0+ds1-5+deb9u1ubuntu0.1~esm1`	fixed
Ubuntu	freeimage	20.04	`3.18.0+ds2-1ubuntu1`	vulnerable
Ubuntu	freeimage	20.04	`3.18.0+ds2-1ubuntu2`	vulnerable
Ubuntu	freeimage	20.04	`3.18.0+ds2-1ubuntu3`	vulnerable
Ubuntu	freeimage	20.04	`3.18.0+ds2-1ubuntu3.1`	fixed
Ubuntu	freeimage	22.04	`3.18.0+ds2-6ubuntu3`	vulnerable
Ubuntu	freeimage	22.04	`3.18.0+ds2-6ubuntu4`	vulnerable
Ubuntu	freeimage	22.04	`3.18.0+ds2-6ubuntu5`	vulnerable
Ubuntu	freeimage	22.04	`3.18.0+ds2-6ubuntu5.1`	fixed
Ubuntu	freeimage	24.04	`3.18.0+ds2-9.1`	vulnerable
Ubuntu	freeimage	24.04	`3.18.0+ds2-10`	vulnerable
Ubuntu	freeimage	24.04	`3.18.0+ds2-10build2`	vulnerable
Ubuntu	freeimage	24.04	`3.18.0+ds2-10build3`	vulnerable
Ubuntu	freeimage	24.04	`3.18.0+ds2-10build4`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	freeimage	source	sid	`(unfixed)`	not yet assigned	Not reported	[947477]
Debian	freeimage	source	trixie	`(unfixed)`	not yet assigned	Not reported	[947477]
Debian	freeimage	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[947477]
Ubuntu	freeimage	deb	pro	`3.17.0+ds1-5+deb9u1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2019-12212	Not reported
Ubuntu	freeimage	deb	20.04	`3.18.0+ds2-1ubuntu3.1`	Not reported	UBUNTU-CVE-2019-12212	Not reported
Ubuntu	freeimage	deb	22.04	`3.18.0+ds2-6ubuntu5.1`	Not reported	UBUNTU-CVE-2019-12212	Not reported
Ubuntu	freeimage	deb	24.04	`3.18.0+ds2-10build4`	Not reported	UBUNTU-CVE-2019-12212	Not reported

[Debian bug #947477]

Notes

[trixie] freeimage: Revisit when upstream fixes are available [bookworm] freeimage: Revisit when upstream fixes are available

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libfreeimage3]Affected
Source package: [freeimage]
Details (4)
- 3.18.0+ds2-9+deb12u1 · amd64 · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · arm64 · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
[libfreeimage-dev]Affected
Source package: [freeimage]
Details (4)
- 3.18.0+ds2-9+deb12u1 · amd64 · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · arm64 · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
[libfreeimageplus3]Affected
Source package: [freeimage]
Details (4)
- 3.18.0+ds2-9+deb12u1 · amd64 · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · arm64 · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
[libfreeimageplus-dev]Affected
Source package: [freeimage]
Details (4)
- 3.18.0+ds2-9+deb12u1 · amd64 · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · arm64 · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
[libfreeimageplus-doc]Affected
Source package: [freeimage]
Details (4)
- 3.18.0+ds2-9+deb12u1 · all · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · all · bookworm
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · all · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12
- 3.18.0+ds2-9+deb12u1 · all · bookworm-security
  Affected
  dsa · freeimage · debian · bookworm; dsa · freeimage · debian · 12

[Debian 13 (Trixie)]

[libfreeimage3]Affected
Source package: [freeimage]
Details (2)
- 3.18.0+ds2-11 · amd64 · trixie
  Affected
  dsa · freeimage · debian · 13
- 3.18.0+ds2-11 · arm64 · trixie
  Affected
  dsa · freeimage · debian · 13
[libfreeimage-dev]Affected
Source package: [freeimage]
Details (2)
- 3.18.0+ds2-11 · amd64 · trixie
  Affected
  dsa · freeimage · debian · 13
- 3.18.0+ds2-11 · arm64 · trixie
  Affected
  dsa · freeimage · debian · 13
[libfreeimageplus3]Affected
Source package: [freeimage]
Details (2)
- 3.18.0+ds2-11 · amd64 · trixie
  Affected
  dsa · freeimage · debian · 13
- 3.18.0+ds2-11 · arm64 · trixie
  Affected
  dsa · freeimage · debian · 13
[libfreeimageplus-dev]Affected
Source package: [freeimage]
Details (2)
- 3.18.0+ds2-11 · amd64 · trixie
  Affected
  dsa · freeimage · debian · 13
- 3.18.0+ds2-11 · arm64 · trixie
  Affected
  dsa · freeimage · debian · 13
[libfreeimageplus-doc]Affected
Source package: [freeimage]
Details (2)
- 3.18.0+ds2-11 · all · trixie
  Affected
  dsa · freeimage · debian · 13
- 3.18.0+ds2-11 · all · trixie
  Affected
  dsa · freeimage · debian · 13

Observed: Oct 23, 2026, 5:39:29 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]