Heap-based buffer overflow in the IMG_LoadLBM_RW function in IMG_lbm.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted IFF ILBM file. NOTE: some of these details are obtained from third party information.

The LWZReadByte() and IMG_LoadLBM_RW() functions in SDL_image contain a boundary error that could be triggered to cause a static buffer overflow and a heap-based buffer overflow. If a user using an application linked against the SDL_image library were to open a carefully crafted GIF or IFF ILBM file, the application could crash or possibly allow for the execution of arbitrary code.

The updated packages have been patched to correct this issue.

Secunia reports :

Two vulnerabilities have been reported in SDL_image, which can be exploited by malicious people to cause a Denial of Service or potentially compromise an application using the library.

A boundary error within the LWZReadByte() function in IMG_gif.c can be exploited to trigger the overflow of a static buffer via a specially crafted GIF file.

A boundary error within the 'IMG_LoadLBM_RW()' function in IMG_lbm.c can be exploited to cause a heap-based buffer overflow via a specially crafted IFF ILBM file.

Michael Skladnikiewicz discovered that SDL_image did not correctly load GIF images. If a user or automated system were tricked into processing a specially crafted GIF, a remote attacker could execute arbitrary code or cause a crash, leading to a denial of service.
(CVE-2007-6697)

David Raulo discovered that SDL_image did not correctly load ILBM images. If a user or automated system were tricked into processing a specially crafted ILBM, a remote attacker could execute arbitrary code or cause a crash, leading to a denial of service. (CVE-2008-0544).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200802-01 (SDL_image: Two buffer overflow vulnerabilities)

    The LWZReadByte() function in file IMG_gif.c and the IMG_LoadLBM_RW()     function in file IMG_lbm.c each contain a boundary error that can be     triggered to cause a static buffer overflow and a heap-based buffer     overflow. The first boundary error comes from some old vulnerable GD     PHP code (CVE-2006-4484).
  Impact :

    A remote attacker can make an application using the SDL_image library     to process a specially crafted GIF file or IFF ILBM file that will     trigger a buffer overflow, resulting in the execution of arbitrary code     with the permissions of the application or the application crash.
  Workaround :

    There is no known workaround at this time.

Several local/remote vulnerabilities have been discovered in the image loading library for the Simple DirectMedia Layer 1.2. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6697     Gynvael Coldwind discovered a buffer overflow in GIF     image parsing, which could result in denial of service     and potentially the execution of arbitrary code.

  - CVE-2008-0544     It was discovered that a buffer overflow in IFF ILBM     image parsing could result in denial of service and     potentially the execution of arbitrary code.

- Tue Jan 29 2008 Brian Pepple <bpepple at     fedoraproject.org> - 1.2.5-7

    - Add patch to fix ILBM image buffer overflow. (#430693)

    - Thu Jan 24 2008 Brian Pepple <bpepple at       fedoraproject.org> - 1.2.5-6

    - Add patch to fix buffer-overflow. (#430100)

    - Sun Aug 5 2007 Brian Pepple <bpepple at       fedoraproject.org> - 1.2.5-5

    - Update license tag.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Jan 29 2008 Brian Pepple <bpepple at     fedoraproject.org> - 1.2.6-5

    - Add patch to fix ILBM image buffer overflow. (#430693)

    - Thu Jan 24 2008 Brian Pepple <bpepple at       fedoraproject.org> - 1.2.6-4

    - Add patch to fix buffer-overflow. (#430100)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
36980	Mandriva Linux Security Advisory : SDL_image (MDVSA-2008:040)	Nessus	Mandriva Local Security Checks	critical
32148	FreeBSD : sdl_image -- buffer overflow vulnerabilities (b1bcab7d-1880-11dd-a914-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	critical
31703	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : sdl-image1.2 vulnerabilities (USN-595-1)	Nessus	Ubuntu Local Security Checks	critical
30243	GLSA-200802-01 : SDL_image: Two buffer overflow vulnerabilities	Nessus	Gentoo Local Security Checks	critical
30232	Debian DSA-1493-2 : sdl-image1.2 - buffer overflows	Nessus	Debian Local Security Checks	critical
30159	Fedora 7 : SDL_image-1.2.5-7.fc7 (2008-1231)	Nessus	Fedora Local Security Checks	critical
30158	Fedora 8 : SDL_image-1.2.6-5.fc8 (2008-1208)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2008-0544

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical