CVE-2024-28578

What it actually does

Buffer overflow in the Load() function of FreeImage 3.19.0 when parsing RAS format images allows local attackers to execute arbitrary code.

Why it matters to the business

Attackers with local access can run their own code on affected systems, leading to full machine compromise and potential data or service loss; the large number of listed Perl packages on AlmaLinux 8 increases exposure surface across development and build environments.

How an attack unfolds

An attacker supplies a specially crafted RAS image file to any application using the vulnerable FreeImage Load() function; the malformed image triggers an out-of-bounds write that overwrites control data, allowing the attacker to redirect execution to attacker-controlled code.

How to fix it

Update all affected AlmaLinux 8 Perl packages to the listed fixed versions: perl-generators 1.11-4.module_el8.4.0+2367+01326e37, perl-Algorithm-Diff 1.1903-10.module_el8.6.0+2766+8bf0b7ce, perl-Archive-Tar 2.32-440.module_el8.3.0+6149+d2c5d96d, perl-Archive-Zip 1.67-1.module_el8.3.0+6149+d2c5d96d, perl-CPAN 2.27-2.module_el8.3.0+6149+d2c5d96d, perl-CPAN-Meta 2.150010-397.module_el8.6.0+2766+8bf0b7ce, perl-CPAN-Meta-Requirements 2.140-397.module_el8.1.0+6019+b22674e1, perl-CPAN-Meta-YAML 0.018-1001.module_el8.6.0+2766+8bf0b7ce, perl-Carp 1.50-439.module_el8.3.0+6149+d2c5d96d, perl-Compress-Bzip2 2.26-7.module_el8.1.0+6019+b22674e1, perl-Compress-Raw-Bzip2 2.093-1.module_el8.4.0+2367+01326e37, perl-Compress-Raw-Zlib 2.093-1.module_el8.3.0+6149+d2c5d96d, perl-Config-Perl-V 0.32-441.module_el8.4.0+2367+01326e37, perl-DB_File 1.852-4.module_el8.4.0+2367+01326e37, perl-Data-Dumper 2.174-440.module_el8.4.0+2367+01326e37, perl-Data-OptList 0.110-7.module_el8.1.0+6019+b22674e1, perl-Data-Section 0.200007-8.module_el8.4.0+2367+01326e37, perl-Devel-PPPort 3.56-1.module_el8.5.0+160+d7199140, perl-Devel-Size 0.83-3.module_el8.4.0+2367+01326e37, perl-Digest 1.17-396.module_el8.4.0+2367+01326e37, perl-Digest-MD5 2.55-397.module_el8.4.0+2367+01326e37, perl-Digest-SHA 1:6.02-2.module_el8.6.0+2766+8bf0b7ce, perl-Encode 4:3.01-439.module_el8.4.0+2367+01326e37, perl-Encode-devel 4:3.01-439.module_el8.4.0+2367+01326e37, perl-Env 1.04-396.module_el8.1.0+6019+b22674e1. Remove or isolate any remaining FreeImage 3.19.0 installations.

How to confirm the fix worked

Verify package versions match the fixed releases above using the system package manager; scan for any remaining FreeImage 3.19.0 binaries and confirm they are no longer present or are isolated from untrusted image processing.

Typical attack path

1. Obtain local access or trick a user into processing a malicious RAS file
2. Invoke an application or script that calls FreeImage::Load on the crafted RAS image
3. Trigger the buffer overflow during image parsing
4. Gain arbitrary code execution in the context of the calling process

How to detect it

Review system and application logs for unexpected process crashes or errors during RAS image loading; look for new or modified executables created after image-processing activity.

What your security team should do

• Apply the listed AlmaLinux 8 package updates immediately due to the 938-day publication age and local code-execution impact
• Audit all systems and build pipelines for use of FreeImage or the listed Perl packages when handling RAS images
• Restrict local execution of image-processing tools to trusted users until patches are deployed