CVE catalog

CVE-2024-25447

imlib2: CVE-2024-25447

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.70% · Oct 25, 2026

An issue in the imlib_load_image_with_error_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianimlib2sid1.12.6-1fixed
Debianimlib2forky1.12.6-1fixed
Debianimlib2trixie1.12.4-2fixed
Debianimlib2bookworm1.10.0-4+deb12u1fixed
Ubuntuimlib214.041.4.5-1ubuntu2vulnerable
Ubuntuimlib214.041.4.6-1vulnerable
Ubuntuimlib214.041.4.6-2vulnerable
Ubuntuimlib214.041.4.6-2ubuntu0.1vulnerable
Ubuntuimlib216.041.4.7-1vulnerable
Ubuntuimlib216.041.4.7-1build1vulnerable
Ubuntuimlib216.041.4.7-1ubuntu0.1vulnerable
Ubuntuimlib218.041.4.8-1vulnerable
Ubuntuimlib218.041.4.8-2vulnerable
Ubuntuimlib218.041.4.10-1vulnerable
Ubuntuimlib220.041.5.1-1vulnerable
Ubuntuimlib220.041.6.1-1vulnerable
Ubuntuimlib220.041.6.1-1ubuntu0.1vulnerable
Ubuntuimlib222.041.7.1-2vulnerable
Ubuntuimlib222.041.7.4-1vulnerable
Ubuntuimlib222.041.7.4-1build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianimlib2sourcesid1.10.0-2not yet assignedNot reportedNot reported
Debianimlib2sourceforky1.10.0-2not yet assignedNot reportedNot reported
Debianimlib2sourcetrixie1.10.0-2not yet assignedNot reportedNot reported
Debianimlib2sourcebookworm1.10.0-2not yet assignedNot reportedNot reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]