Multiple stack-based buffer overflows in Imlib 2 (aka imlib2) 1.4.0 allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via (1) a PNM image with a crafted header, related to the load function in src/modules/loaders/loader_pnm.c; or (2) a crafted XPM image, related to the load function in src/modules/loader_xpm.c.

This update fixes two security problems in imlib2.

Specially crafted xpm files could trigger a stack based buffer overflow in imlib2 which could potentially be exploited to execute arbitrary code (CVE-2008-2426).

A crash in PNM handling due to a NULL pointer dereference was fixed.

Stefan Cornelius discovered two buffer overflows in Imlib's image loaders for PNM and XPM images, which could possibly result in the execution of arbitrary code (CVE-2008-2426).

The updated packages have been patched to prevent this issue.

It was discovered that Imlib2 did not correctly handle certain malformed XPM and PNG images. If a user were tricked into opening a specially crafted image with an application that uses Imlib2, an attacker could cause a denial of service and possibly execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes two security problems in imlib2.

Specially crafted xpm files could trigger a stack based buffer overflow in imlib2 which could potentially be exploited to execute arbitrary code. (CVE-2008-2426)

A crash in PNM handling due to a NULL pointer dereference was fixed.

Stefan Cornelius discovered two buffer overflows in Imlib's - a powerful image loading and rendering library - image loaders for PNM and XPM images, which may result in the execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200806-03 (Imlib 2: User-assisted execution of arbitrary code)

    Stefan Cornelius (Secunia Research) reported two boundary errors in     Imlib2:
    One of them within the load() function in the     file src/modules/loaders/loader_pnm.c when processing the header of a     PNM image file, possibly leading to a stack-based buffer overflow.
    The second one within the load() function in the file     src/modules/loader_xpm.c when processing an XPM image file, possibly     leading to a stack-based buffer overflow.
  Impact :

    A remote attacker could entice a user to open a specially crafted PNM     or XPM image, possibly resulting in the execution of arbitrary code     with the rights of the user running the application using Imlib 2.
  Workaround :

    There is no known workaround at this time.

Fix CVE-2008-2426 / SA30401 - buffer overflow in the XPM loader.
http://secunia.com/advisories/30401/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
39988	openSUSE Security Update : imlib2 (imlib2-178)	Nessus	SuSE Local Security Checks	high
37626	Mandriva Linux Security Advisory : imlib2 (MDVSA-2008:123)	Nessus	Mandriva Local Security Checks	high
36815	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : imlib2 vulnerability (USN-697-1)	Nessus	Ubuntu Local Security Checks	high
34194	SuSE 10 Security Update : imlib2 (ZYPP Patch Number 5572)	Nessus	SuSE Local Security Checks	high
34193	openSUSE 10 Security Update : imlib2 (imlib2-5571)	Nessus	SuSE Local Security Checks	high
33175	Debian DSA-1594-1 : imlib2 - buffer overflows	Nessus	Debian Local Security Checks	high
33118	GLSA-200806-03 : Imlib 2: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
33083	Fedora 7 : imlib2-1.3.0-4.fc7 (2008-4950)	Nessus	Fedora Local Security Checks	high
33080	Fedora 9 : imlib2-1.4.0-7.fc9 (2008-4871)	Nessus	Fedora Local Security Checks	high
33078	Fedora 8 : imlib2-1.4.0-7.fc8 (2008-4842)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-2426

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high