AI analysis
Imager, a Perl image-manipulation library, versions before 1.037 miscalculate a heap buffer size (CWE-131) in the i_gsampf_fp routine when float samples are fetched from a paletted image. When code calls getsamples() with type "float" on a paletted image, the library allocates space for only one sample per pixel but writes every requested channel of each pixel into that buffer, so requesting more than one channel writes past the end. An attacker-supplied image can control the overflowing bytes through its palette entries, turning this into a heap overflow with attacker-influenced content that could crash the process or potentially lead to code execution. Any application or service built on Imager before 1.037 that processes untrusted paletted images and fetches multi-channel float samples is affected. No public proof of concept exists and the issue is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is none known.
What to do: Upgrade Imager to version 1.037 or later, which is the first fixed release. Audit Perl code for calls to getsamples()/i_gsampf_fp with type "float" on paletted images fed by untrusted users, and as an interim mitigation, reject or convert paletted images before sampling or restrict image uploads to trusted sources.
Affected
| Imager (Perl, CPAN) Imager | before 1.037 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end. An attacker-supplied image controls the overflowing bytes through its palette.