CVE-2024-53901

Publication date 24 November 2024

Last updated 11 July 2025

Ubuntu priority

Cvss 3 Severity Score

Description

The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libimager-perl	25.10 questing	Not affected
	25.04 plucky	Not affected
	24.10 oracular	Ignored end of life, was needs-triage
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation

How can I get the fixes?
What do statuses mean?

Severity score breakdown

Parameter	Value
Base score	5.5 · Medium
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.cve.org/CVERecord?id=CVE-2024-53901
https://github.com/tonycoz/imager/issues/534
https://github.com/tonycoz/imager/commit/7851737838aa86113b276aea02729cc1f6e9eed0 (v1.025)
https://github.com/briandfoy/cpan-security-advisory/issues/167
https://github.com/briandfoy/cpan-security-advisory/issues/171
https://metacpan.org/release/TONYC/Imager-1.025/changes