CVE-2024-28584

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the J2KImageToFIBITMAP() function when reading images in J2K format.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
freeimage_project	freeimage	3.19.0

References

http://www.openwall.com/lists/oss-security/2024/04/11/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/11/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/11/3Mailing List, Third Party Advisory
https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909Exploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/11/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/11/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/11/3Mailing List, Third Party Advisory
https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909Exploit, Third Party Advisory

Timeline

Published: Mar 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-285896.7An issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbi CVE-2024-28597.2By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remo CVE-2024-285935.4The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads CVE-2024-285959.8SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in CVE-2024-28607.8The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker CVE-2024-286072.9The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as glo CVE-2024-28615.4The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up CVE-2024-286139.8SQL Injection vulnerability in PHP Task Management System v.1.0 allows a remote attacker to escalate privileges and obtain sensitive informa CVE-2024-28629.8This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.CVE-2024-286236.1RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.CVE-2024-286277.5An issue in Flipsnack v.18/03/2024 allows a local attacker to obtain sensitive information via the reader.gz.js file.CVE-2024-28639.8This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.