Description
Heap-based buffer overflow in the BMP reader (bmp.c) in Imager perl module (libimager-perl) 0.45 through 0.56 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted 8-bit/pixel compressed BMP files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libimager-perl | 0.58-1 | — |
| Debian 13 | libimager-perl | 0.58-1 | — |
| Debian 12 | libimager-perl | 0.58-1 | — |
| Debian 4.0 | libimager-perl | 0.50-1etch1 | DSA-1498-1 |
Advisories 1
- DSA-1498-1 libimager-perl - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 35470 vdb-entry
- 39846 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=421582
- DSA-1498 vendor-advisory
- 23711 vdb-entry
- http://imager.perl.org/a/65.html
- 25038 third-party-advisory
- 28868 third-party-advisory
- http://rt.cpan.org/Public/Bug/Display.html?id=26811
- ADV-2007-1587 vdb-entry
- imager-bmpfile-bo(34010) vdb-entry