Multiple stack-based buffer overflows in the iGetHdrHeader function in src-IL/src/il_hdr.c in DevIL 1.7.4 allow context-dependent attackers to execute arbitrary code via a crafted Radiance RGBE file.

- Fix missing symbols (rh 480269) - Fix off by one error     in CVE-2008-5262 check (rh 479864)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200903-04 (DevIL: User-assisted execution of arbitrary code)

    Stefan Cornelius (Secunia Research) discovered two boundary errors     within the iGetHdrHeader() function in src-IL/src/il_hdr.c.
  Impact :

    A remote attacker could entice a user to open a specially crafted     Radiance RGBE file, possibly resulting in the execution of arbitrary     code.
  Workaround :

    There is no known workaround at this time.

Stefan Cornelius discovered a buffer overflow in devil, a cross-platform image loading and manipulation toolkit, which could be triggered via a crafted Radiance RGBE file. This could potentially lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
37947	Fedora 10 : DevIL-1.7.5-2.fc10 (2009-0867)	Nessus	Fedora Local Security Checks	high
35794	GLSA-200903-04 : DevIL: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
35612	Debian DSA-1717-1 : devil - buffer overflow	Nessus	Debian Local Security Checks	high
35441	Fedora 9 : DevIL-1.7.5-2.fc9 (2009-0856)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-5262

high

Tenable Plugins

high

high

high

high