Multiple vulnerabilities in xli before 1.17 may allow remote attackers to execute arbitrary code via "buffer management errors" from certain image properties, some of which may be related to integer overflows in PPM files.

Tavis Ormandy discovered several integer overflows in xli's image size handling. A maliciously crafted image may be able to cause a heap buffer overflow and execute arbitrary code.

A number of vulnerabilities have been found in the xli image viewer.
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a flaw in the handling of compressed images where shell meta-characters are not properly escaped (CVE-2005-0638). It was also found that insufficient validation of image properties could potentially result in buffer management errors (CVE-2005-0639).

The updated packages have been patched to correct these problems.

A number of vulnerabilities were discovered by Stefano Di Paola in the MySQL server :

If an authenticated user had INSERT privileges on the 'mysql' database, the CREATE FUNCTION command allowed that user to use libc functions to execute arbitrary code with the privileges of the user running the database server (mysql) (CVE-2005-0709).

If an authenticated user had INSERT privileges on the 'mysql' database, it was possible to load a library located in an arbitrary directory by using INSERT INTO mysql.func instead of CREATE FUNCTION.
This also would allow the user to execute arbitrary code with the privileges of the user running the database server (CVE-2005-0710).

Finally, temporary files belonging to tables created with CREATE TEMPORARY TABLE were handled in an insecure manner, allowing any local user to overwrite arbitrary files with the privileges of the database server (CVE-2005-0711).

The updated packages have been patched to correct these issues.

Several vulnerabilities have been discovered in xli, an image viewer for X11. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2001-0775     A buffer overflow in the decoder for FACES format images     could be exploited by an attacker to execute arbitrary     code. This problem has already been fixed in xloadimage     in DSA 069.

  - CAN-2005-0638

    Tavis Ormandy of the Gentoo Linux Security Audit Team     has reported a flaw in the handling of compressed     images, where shell meta-characters are not adequately     escaped.

  - CAN-2005-0639

    Insufficient validation of image properties in have been     discovered which could potentially result in buffer     management errors.

Several vulnerabilities have been discovered in xloadimage, an image viewer for X11. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-0638     Tavis Ormandy of the Gentoo Linux Security Audit Team     has reported a flaw in the handling of compressed     images, where shell meta-characters are not adequately     escaped.

  - CAN-2005-0639

    Insufficient validation of image properties have been     discovered which could potentially result in buffer     management errors.

The remote host is affected by the vulnerability described in GLSA-200503-05 (xli, xloadimage: Multiple vulnerabilities)

    Tavis Ormandy of the Gentoo Linux Security Audit Team has reported that     xli and xloadimage contain a flaw in the handling of compressed images,     where shell meta-characters are not adequately escaped. Rob Holland of     the Gentoo Linux Security Audit Team has reported that an xloadimage     vulnerability in the handling of Faces Project images discovered by     zen-parse in 2001 remained unpatched in xli. Additionally, it has been     reported that insufficient validation of image properties in xli could     potentially result in buffer management errors.
  Impact :

    Successful exploitation would permit a remote attacker to execute     arbitrary shell commands, or arbitrary code with the privileges of the     xloadimage or xli user.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
19107	FreeBSD : xli -- integer overflows in image size calculations (bfbbd505-3bd6-409c-8c67-445d3635cf4b)	Nessus	FreeBSD Local Security Checks	high
18106	Mandrake Linux Security Advisory : xli (MDKSA-2005:076)	Nessus	Mandriva Local Security Checks	high
17601	Mandrake Linux Security Advisory : MySQL (MDKSA-2005:060)	Nessus	Mandriva Local Security Checks	high
17578	Debian DSA-695-1 : xli - buffer overflow, input sanitising, integer overflow	Nessus	Debian Local Security Checks	high
17577	Debian DSA-694-1 : xloadimage - missing input sanitising, integer overflow	Nessus	Debian Local Security Checks	high
17261	GLSA-200503-05 : xli, xloadimage: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-0639

critical

Tenable Plugins

high

high

high

high

high

high