imlib2 BMP Decoding Buffer Overflow May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1011105 |
|
SecurityTracker URL: http://securitytracker.com/id/1011105
|
|
CVE Reference:
CAN-2004-0802
(Links to External Site)
|
Date: Aug 31 2004
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 1.1.1 and prior versions
|
Description:
A vulnerability was reported in imlib2 in the processing of BMP images. A remote user can cause imlib2 to crash or potentially execute arbitrary code.
The vendor reported that a remote user can create a specially crafted BMP image file containing runlength-encoded images that, when decoded by the target user, will cause imlib2 to crash.
Marcus Meissner discovered this vulnerability.
A demonstration exploit image from Chris Evans is available at:
http://bugzilla.gnome.org/attachment.cgi?id=30933&action=view
|
Impact:
A remote user can create a BMP file that, when decoded by the target user, will cause imlib2 to crash. It may also be possible to cause arbitrary code to be executed. The specific impact depends on the application using imlib2.
|
Solution:
A fix is available via CVS:
http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/
|
Cause:
Boundary error
|
Underlying OS:
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 31 Aug 2004 14:38:18 -0400
Subject: http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&view=markup
|
CVE: CAN-2004-0802
|
|
