MediumFix available
cimg — security advisory
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
- Products
- cimg
- Affected versions
- Not specified
- Fixed versions
- 3.1.6+dfsg-1
- CVEs
- CVE-2022-1325
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:34 UTC · Revision 1
Source evidence
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
osv:DEBIAN-CVE-2022-1325
cimg
Fixed versions: 3.1.6+dfsg-1
cimg
Fixed versions: 3.1.6+dfsg-1
cimg
Fixed versions: 3.1.6+dfsg-1
Complete source record
{
"id": "5671ba8c557fcd92d93cabc89547e4d8bdd608e53f5f3f39797cc3c35b863608",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-1325",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-1325",
"summary": "A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.",
"evidence": "osv:DEBIAN-CVE-2022-1325",
"products": [
{
"name": {
"value": "cimg",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.6+dfsg-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "cimg",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.6+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "cimg",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.6+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2022-1325",
"aliases": [
"DEBIAN-CVE-2022-1325"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.6+dfsg-1"
}
]
}
],
"package": {
"name": "cimg",
"purl": "pkg:deb/debian/cimg?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-1325.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.6+dfsg-1"
}
]
}
],
"package": {
"name": "cimg",
"purl": "pkg:deb/debian/cimg?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-1325.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.6+dfsg-1"
}
]
}
],
"package": {
"name": "cimg",
"purl": "pkg:deb/debian/cimg?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-1325.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:00:40.105958891Z",
"provider": "osv",
"upstream": [
"CVE-2022-1325"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-1325"
]
},
"related_cves": [
{
"value": "CVE-2022-1325",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 322579,
"published_at": "2022-08-31T16:15:09.467+00:00"
}