SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Imlib Vendors:   [Multiple Authors/Vendors]
imlib BMP Decoding Buffer Overflow May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1011104
SecurityTracker URL:  http://securitytracker.com/id/1011104
CVE Reference:   CVE-2004-0817   (Links to External Site)
Date:  Aug 31 2004
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.9.14
Description:   A vulnerability was reported in imlib in the processing of BMP images. A remote user can cause imlib to crash or potentially execute arbitrary code.

The vendor reported that a remote user can create a specially crafted BMP image file containing runlength-encoded images that, when decoded by the target user, will cause imblib to crash.

Marcus Meissner discovered this vulnerability.

A demonstration exploit image from Chris Evans is available at:

http://bugzilla.gnome.org/attachment.cgi?id=30933&action=view

Impact:   A remote user can create a BMP file that, when decoded by the target user, will cause imlib to crash. It may also be possible to cause arbitrary code to be executed. The specific impact depends on the application using imlib.
Solution:   A patch is available at:

http://bugzilla.gnome.org/attachment.cgi?id=30934&action=view

Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Sep 8 2004 (Mandrake Issues Fix) imlib BMP Decoding Buffer Overflow May Let Remote Users Execute Arbitrary Code
Mandrake has released a fix.
Sep 15 2004 (Red Hat Issues Fix for RHEL) imlib BMP Decoding Buffer Overflow May Let Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux 2.1 and 3.
Sep 16 2004 (Debian Issues Fix) imlib BMP Decoding Buffer Overflow May Let Remote Users Execute Arbitrary Code
Debian has released a fix.
Sep 19 2004 (Sun Issues Fix for Sun Java Desktop System) imlib BMP Decoding Buffer Overflow May Let Remote Users Execute Arbitrary Code
Sun has issued a fix for Sun Java Desktop System (JDS).
Sep 28 2004 (Conectiva Issues Fix) imlib BMP Decoding Buffer Overflow May Let Remote Users Execute Arbitrary Code
Conectiva has released a fix.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC