CPANSA-Alien-FreeImage-2022-4988: Alien-FreeImage vulnerability

Publisher	giterlizzi	Document category	csaf_security_advisory
Initial release date	2026-05-11T00:00:00	Engine	CSAF Perl Toolkit 0.26
Current release date	2026-05-11T00:00:00	Build Date
Current version	1	Status	final
CVSS v3.1 Base Score	7.3	Severity
Original language		Language	en
Also referred to

Vulnerability Description

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries. Alien::FreeImage contains version 3.17.0 of the FreeImage library from 2017, which has known vulnerabilities such as CVE-2015-0852 and CVE-2025-65803. The library embeds other images libraries that also have known vulnerabilities.

Vulnerabilities

CVE-2022-4988

Vulnerability Description

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries.

Alien::FreeImage contains version 3.17.0 of the FreeImage library from 2017, which has known vulnerabilities such as CVE-2015-0852 and CVE-2025-65803. The library embeds other images libraries that also have known vulnerabilities.

Product status

Known affected

Product

Score

Alien-FreeImage greater than 0

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	7.3	High

CVE-2015-0852

Vulnerability Description

Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window.

Weakness	CWE-189 : Numeric Errors

Product status

Known affected

Product

Score

Alien-FreeImage greater than 0

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
2.0	AV:N/AC:L/Au:N/C:N/I:N/A:P	5.0	Medium

CVE-2025-65803

Vulnerability Description

An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted PSD file.

Weakness	CWE-190 : Integer Overflow or Wraparound

Product status

Known affected

Product

Score

Alien-FreeImage greater than 0

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	6.5	Medium

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

CPANSA-Alien-FreeImage-2022-4988 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-alien-freeimage-2022-4988.json
https://freeimage.sourceforge.io/ external
https://freeimage.sourceforge.io/
https://github.com/kmx/alien-freeimage/issues/4 external
https://github.com/kmx/alien-freeimage/issues/4
https://github.com/kmx/alien-freeimage/issues/5 external
https://github.com/kmx/alien-freeimage/issues/5
https://metacpan.org/release/KMX/Alien-FreeImage-1.001/source/src/Source external
https://metacpan.org/release/KMX/Alien-FreeImage-1.001/source/src/Source
https://nvd.nist.gov/vuln/detail/CVE-2015-0852 external
https://nvd.nist.gov/vuln/detail/CVE-2015-0852
https://nvd.nist.gov/vuln/detail/CVE-2025-65803 external
https://nvd.nist.gov/vuln/detail/CVE-2025-65803
CVE-2022-4988 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2022-4988
CVE-2015-0852 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2015-0852
CVE-2025-65803 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2025-65803

Revision history

Version	Date of the revision	Summary of the revision
1	Mon May 11 00:00:00 2026	First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/