Multiple heap-based buffer overflows in imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files.

Recently, Pavel Kankovsky discovered several buffer overflows in imlib which were fixed in USN-53-1. It was found that imlib2 was vulnerable to similar issues.

If an attacker tricked a user into loading a malicious XPM or BMP image, he could exploit this to execute arbitrary code in the context of the user opening the image.

These vulnerabilities might also lead to privilege escalation if a privileged server process is using this library; for example, a PHP script on the web server which does automatic image processing might use the php-imlib package, in which case a remote attacker could possibly execute arbitrary code with the web server's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pavel Kankovsky discovered several buffer overflows in imlib. If an attacker tricked a user into loading a malicious image, he could exploit this to execute arbitrary code in the context of the user opening the image.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pavel Kankovsky reports :

Imlib affected by a variant of CAN-2004-0782 too.

I've discovered more vulnerabilities in Imlib (1.9.13). In particular, it appears to be affected by a variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see http://scary.beasts.org/security/CESA-2004-003.txt). Look at the attached image, it kills ee on my 7.3.

The flaws also affect imlib2.

Pavel Kankovsky discovered several heap overflow flaw in the imlib image handler. An attacker could create a carefully crafted image file in such a way that it could cause an application linked with imlib to execute arbitrary code when the file was opened by a user (CVE-2004-1025).

As well, Pavel also discovered several integer overflows in imlib.
These could allow an attacker, creating a carefully crafted image file, to cause an application linked with imlib to execute arbitrary code or crash (CVE-2004-1026).

The updated packages have been patched to prevent these problems.

Pavel Kankovsky discovered that several overflows found in the libXpm library were also present in imlib and imlib2, imaging libraries for X11. An attacker could create a carefully crafted image file in such a way that it could cause an application linked with imlib or imlib2 to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2004-1025     Multiple heap-based buffer overflows. No such code is     present in imlib2.

  - CAN-2004-1026

    Multiple integer overflows in the imlib library.

Pavel Kankovsky discovered that several overflows found in the libXpm library were also present in imlib, an imaging library for X and X11.
An attacker could create a carefully crafted image file in such a way that it could cause an application linked with imlib to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2004-1025     Multiple heap-based buffer overflows.

  - CAN-2004-1026

    Multiple integer overflows.

Updated imlib packages that fix several integer and buffer overflows are now available.

[Updated Dec 22, 2004] Added multilib packages to the Itanium, PPC, AMD64/Intel EM64T, and IBM eServer zSeries architectures for Red Hat Enterprise Linux version 3.

The imlib packages contain an image loading and rendering library.

Pavel Kankovsky discovered several heap overflow flaws that were found in the imlib image handler. An attacker could create a carefully crafted image file in such a way that it could cause an application linked with imlib to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1025 to this issue.

Additionally, Pavel discovered several integer overflow flaws that were found in the imlib image handler. An attacker could create a carefully crafted image file in such a way that it could cause an application linked with imlib to execute arbitrary code or crash when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1026 to this issue.

Users of imlib should update to these updated packages, which contain backported patches and are not vulnerable to this issue.

ID	Name	Product	Family	Severity
20673	Ubuntu 4.10 : imlib2 vulnerabilities (USN-55-1)	Nessus	Ubuntu Local Security Checks	critical
20671	Ubuntu 4.10 : imlib+png2 vulnerabilities (USN-53-1)	Nessus	Ubuntu Local Security Checks	critical
18864	FreeBSD : imlib -- xpm heap buffer overflows and integer overflows (2001103a-6bbd-11d9-851d-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	critical
16158	Mandrake Linux Security Advisory : imlib (MDKSA-2005:007)	Nessus	Mandriva Local Security Checks	critical
16106	Debian DSA-628-1 : imlib2 - integer overflows	Nessus	Debian Local Security Checks	critical
16049	Debian DSA-618-1 : imlib - buffer overflows, integer overflows	Nessus	Debian Local Security Checks	critical
15947	RHEL 2.1 / 3 : imlib (RHSA-2004:651)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2004-1025

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical