CVE-2019-1010174

State: Published
Severity: Not scored
Published: Jul 25, 2019
Updated: Aug 5, 2024
Reserved: Mar 20, 2019

Description

CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector is: Loading an image from a user-controllable url can lead to command injection, because no string sanitization is done on the url. The fixed version is: v.2.3.4.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
The CImg LibraryCImg	v.2.3.3 and earlier [fixed: v.2.3.4]Affected

References

https://framagit.org/dtschump/CImg/commit/5ce7a426b77f814973e56182a0e76a2b04904146
[debian-lts-announce] 20190928 [SECURITY] [DLA 1934-1] cimg security updatemailing-list
[debian-lts-announce] 20201030 [SECURITY] [DLA 2421-1] cimg security updatemailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.