Hi,

The following vulnerability was published for freeimage.

CVE-2023-47995[0]:
| Buffer Overflow vulnerability in
| BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0
| allows attackers to cause a denial of service.

The only reference for now is [1] unclear if there is some development
around it.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-47995
https://www.cve.org/CVERecord?id=CVE-2023-47995
[1] https://github.com/thelastede/FreeImage-cve-poc/tree/master/CVE-2023-47995

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
freeimage, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1060862@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Anton Gladky <gladk@debian.org> (supplier of updated freeimage package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 17 Oct 2026 19:26:24 +0200
Source: freeimage
Binary: libfreeimage-dev libfreeimage4 libfreeimage4-dbgsym libfreeimageplus-dev libfreeimageplus4 libfreeimageplus4-dbgsym
Architecture: source amd64
Version: 4.2.1+ds-1~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed-By: Anton Gladky <gladk@debian.org>
Description:
 libfreeimage-dev - Support library for graphics image formats (development files)
 libfreeimage4 - Support library for graphics image formats (library)
 libfreeimageplus-dev - C++ wrappers for FreeImage (development files)
 libfreeimageplus4 - C++ wrappers for freeimage (library)
Closes: 1055305 1059152 1060691 1060862 1068718 1082375 1121912 1138102
Changes:
 freeimage (4.2.1+ds-1~exp1) experimental; urgency=medium
 .
   * New upstream release: switch to FreeImageRe 4.2.1, a maintained fork
     (Closes: #1121912). FreeImage itself is dead upstream with open
     security issues; FreeImageRe carries CVE fixes and active
     maintenance.
   * CMake-based build, replacing the old Makefile-based one.
   * SONAME bump (libfreeimage3 -> libfreeimage4, libfreeimageplus3 ->
     libfreeimageplus4): abidiff against the previous upload found a
     removed function and a changed signature.
   * FreeImagePlus ported forward from FreeImage 3.18 (upstream dropped
     it), with the changes listed in Wrapper/FreeImagePlus/PORTING.txt.
     fipImage::getHistogram() keeps the FreeImage 3.18 implementation.
   * Vendor a pinned Yato copy (a header-only FreeImageRe dependency with
     no Debian package).
   * Build against the system jxrlib; the embedded copy is removed from
     the orig tarball.
   * Load libheif by its SONAME, so HEIF/AVIF support works without
     libheif-dev installed, and recommend libheif1.
   * Build the library with the colour order the installed header uses on
     the host architecture (BGR on little-endian, RGB on big-endian).
   * Drop libfreeimageplus-doc for now (doxygen config not ported yet).
   * debian/copyright, debian/patches: rewritten for the new source.
     Upstream-Contact now points to the FreeImageRe project.
     (Closes: #1082375)
   * The switch to FreeImageRe supersedes packaging FreeImage r1909.
     (Closes: #1068718)
   * autopkgtest: enable the per-format upstream tests and add a
     FreeImagePlus test.
   * debian/watch: convert to version 5 and track upstream releases.
   * Security fixes included in FreeImageRe:
     - CVE-2020-24292: ICO load() buffer overflow.
     - CVE-2020-24293, CVE-2020-24294, CVE-2020-24295: PSD plugin
       buffer overflows. (Closes: #1059152)
     - CVE-2021-40266: TIFF ReadPalette NULL pointer dereference.
       (Closes: #1055305)
     - CVE-2023-47992: _MemoryReadProc integer overflow.
     - CVE-2023-47993: Exif ReadInt32 out-of-bounds read.
     - CVE-2023-47994: BMP LoadPixelDataRLE4 integer overflow.
     - CVE-2023-47996: Exif jpeg_read_exif_dir integer overflow.
     - CVE-2023-47997: FreeImage_AllocateBitmap infinite loop.
       (Closes: #1060691)
     - CVE-2023-47995: FreeImage_AllocateBitmap excessive allocation.
       (Closes: #1060862)
     - CVE-2024-28579, CVE-2024-28582: HDR plugin memory errors.
   * Remove Ghislain Antony Vaillant from Uploaders. (Closes: #1138102)
Checksums-Sha1:
 25792cb2b9fc436ed323fb63f50f78523ee44f3d 2497 freeimage_4.2.1+ds-1~exp1.dsc
 4ae20a22185c1271148e0b41b5f9c7ec0f24fc39 2389796 freeimage_4.2.1+ds.orig.tar.xz
 bf59f99d124f4adde428015f9df97fd74915d74a 24616 freeimage_4.2.1+ds-1~exp1.debian.tar.xz
 05432d374a78d120b13cb2a7db1608c3a4984a51 9861 freeimage_4.2.1+ds-1~exp1_amd64.buildinfo
 aef64501651fe98a66165665b89498446b1801b2 56948 libfreeimage-dev_4.2.1+ds-1~exp1_amd64.deb
 1129e8bd5c8f1645b52ba23460073122edcef5c2 2989772 libfreeimage4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 bbaf282015c84d5fb038a4c2ded3444f9dcc4d93 422808 libfreeimage4_4.2.1+ds-1~exp1_amd64.deb
 c9e9d4e42a6e4a182ef1a80e2e897fc48ab126ba 44780 libfreeimageplus-dev_4.2.1+ds-1~exp1_amd64.deb
 db83a7f547377db9be7cb4004075211fc4e29548 42888 libfreeimageplus4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 8f2cbc9454e61c69d03402d4fbab430251122685 46584 libfreeimageplus4_4.2.1+ds-1~exp1_amd64.deb
Checksums-Sha256:
 cc555c504d3748e21058be4088702812aec99d3eeacc72dc2cc0bbefb3f66bf7 2497 freeimage_4.2.1+ds-1~exp1.dsc
 bfb3309bd0601d438ace8fe483187dfa77ab132389b6e055c63c9c657a5c98a6 2389796 freeimage_4.2.1+ds.orig.tar.xz
 a41ffa93e0028226cf2154153848cb48e1d56c2b4b7016f838abe0ad83ac1533 24616 freeimage_4.2.1+ds-1~exp1.debian.tar.xz
 d6a5db8f0817fdb661c4c7081cc43a8ee986fcd3006925b9b947270f93adda75 9861 freeimage_4.2.1+ds-1~exp1_amd64.buildinfo
 8eb5d82b5d7b78c50d47e44eedcc86ec6ff403db10ba89a12ca94e1bb90ed268 56948 libfreeimage-dev_4.2.1+ds-1~exp1_amd64.deb
 6b91d049bf106575b699fa033f1a45f42057b3048f5f569c43546d2dec5c9abe 2989772 libfreeimage4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 7fb84f7815dd12476202f9166b447eaa7f93292f4bf0faa9da57b994d42fe69a 422808 libfreeimage4_4.2.1+ds-1~exp1_amd64.deb
 7aac4c8b66922db5e62d65bb1c36785b8fb8a7ac2c5e20e487d4d95eb7259f21 44780 libfreeimageplus-dev_4.2.1+ds-1~exp1_amd64.deb
 9dd72889fbaea1d4f7f3d154534150804a33a6764697d1ca52e3d60f6f876d5a 42888 libfreeimageplus4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 144be88ca8e4a558d54424128c25a865b34a6568e8685fb60b29eb3c67254ca5 46584 libfreeimageplus4_4.2.1+ds-1~exp1_amd64.deb
Files:
 d97762914cf6ecaa27d8471f04fdec3b 2497 libs optional freeimage_4.2.1+ds-1~exp1.dsc
 c307bd18bc4f878384871f2d34bcc40d 2389796 libs optional freeimage_4.2.1+ds.orig.tar.xz
 3beebefad9e4d0649564f6c5047c7553 24616 libs optional freeimage_4.2.1+ds-1~exp1.debian.tar.xz
 4c8bbc302d13b90c078183244c04322e 9861 libs optional freeimage_4.2.1+ds-1~exp1_amd64.buildinfo
 1350ed28f47858740188da4f8ad8f622 56948 libdevel optional libfreeimage-dev_4.2.1+ds-1~exp1_amd64.deb
 0d787fc0aa85e413696e2eaee4d990f7 2989772 debug optional libfreeimage4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 78992a1f1a40eee5aaf6482ec2e1c4ee 422808 libs optional libfreeimage4_4.2.1+ds-1~exp1_amd64.deb
 32cab240df7ea1ef7d15d8f33f9aa53b 44780 libdevel optional libfreeimageplus-dev_4.2.1+ds-1~exp1_amd64.deb
 f45c407eae5a3ae638851f6b1ed6af5b 42888 debug optional libfreeimageplus4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 10359d3f90c1e7cce4d9a7939ed8d02a 46584 libs optional libfreeimageplus4_4.2.1+ds-1~exp1_amd64.deb
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmrTsCIRHGdsYWRrQGRl
Ymlhbi5vcmcACgkQ0+Fzg8+n/wZC7g/+KTszaHoQ2qW2xlkheNCJnEXM3J7wKwon
iqHdLdPlKvTGtBSXL+n1MuEKV7mkiu9Q2UjXbBh7LLK99pBm4NOKBDQ+6dQGUh7P
lsCraMBSOFwhRcDaUMd0DVk02gDJdB6WOQw8gYFJ7s7BAqP5ewpjPKHcnMbrH8+2
7/cZdKbdf2xwsq4r/HAEJywHu5rvhcj09Hlci0yQ+Xou4yo55boy/U1hJ7f4YXGE
6vzAj03ncjpabpYPOslLPIFOqQeLu+8D4Y4pUV1JjFi2bz4KLVM7aRhL2MDGJykW
7ZQAfORb+TWj42BvGlX1eJQ1YkGSEPRP9VTUME3vLc1ZA+jmWD2QPUX9WewjPbLg
yBT1DdOHOa4Ih4clv57jNd5iyE+kpYO0uyywJlUMahX51AieI3O81aEjDC5T1+vc
RP9p0puwK+VRJ6m7tEl+KsU2hYhbsxvFnOXHtsBVUcLdvwyA5oKpEHQfhPbsCMqD
+/GCqoHVda0PWGDdpCF8hJE6dgfU831Pdpm9kkGExevmJl4qD/YRe00i5E2+niy5
wzhGIlze1PvmbTnNp3jFbhPMfEyom45eiIP9s2zRnj+Kf1hMRVAFpQIijm0W4Yqp
lio+IiWmFf4+o15zP4794NiJ98sJw3crCczvPu45Alz6A01QD2seqWhvvMKcFKYa
21SlrT2Jkk4=
=jxyq
-----END PGP SIGNATURE-----