Buffer overflow in the BMP loader in imlib2 before 1.1.2 allows remote attackers to execute arbitrary code via a specially-crafted BMP image, a different vulnerability than CVE-2004-0817.

Marcus Meissner discovered that imlib2's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability. There appears to be both a stack-based and a heap-based buffer overflow that are believed to be exploitable for arbitrary code execution.

Marcus Meissner discovered a heap overflow error in imlib2, an imaging library for X and X11 and the successor of imlib, that may be utilised by an attacker to execute arbitrary code on the victims machine.

Marcus Meissner discovered that the imlib and imlib2 libraries are also affected with a similar BMP-related vulnerability as the recent QT updates. The updated imlib and imlib2 packages are patched to protect against this problem.

The remote host is affected by the vulnerability described in GLSA-200409-12 (ImageMagick, imlib, imlib2: BMP decoding buffer overflows)

    Due to improper bounds checking, ImageMagick and imlib are vulnerable to a     buffer overflow when decoding runlength-encoded bitmaps. This bug can be     exploited using a specially crafted BMP image and could potentially allow     remote code execution when this image is decoded by the user.
  Impact :

    A specially crafted runlength-encoded BMP could lead ImageMagick and imlib     to crash or potentially execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200409-07 (xv: Buffer overflows in image handling)

    Multiple buffer overflow and integer handling vulnerabilities have been     discovered in xv's image processing code. These vulnerabilities have been     found in the xvbmp.c, xviris.c, xvpcx.c and xvpm.c source files.
  Impact :

    An attacker might be able to embed malicious code into an image, which     would lead to the execution of arbitrary code under the privileges of the     user viewing the image.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
36768	FreeBSD : imlib2 -- BMP decoder buffer overflow (ba005226-fb5b-11d8-9837-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	medium
15389	Debian DSA-552-1 : imlib2 - unsanitised input	Nessus	Debian Local Security Checks	high
14678	Mandrake Linux Security Advisory : imlib2 (MDKSA-2004:089)	Nessus	Mandriva Local Security Checks	high
14677	GLSA-200409-12 : ImageMagick, imlib, imlib2: BMP decoding buffer overflows	Nessus	Gentoo Local Security Checks	high
14661	GLSA-200409-07 : xv: Buffer overflows in image handling	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2004-0802

high

Tenable Plugins

medium

high

high

high

medium