Multiple integer overflows in CamlImages 2.2 might allow context-dependent attackers to execute arbitrary code via images containing large width and height values that trigger a heap-based buffer overflow, related to (1) crafted GIF files (gifread.c) and (2) crafted JPEG files (jpegread.c), a different vulnerability than CVE-2009-2295.

The remote host is affected by the vulnerability described in GLSA-201006-02 (CamlImages: User-assisted execution of arbitrary code)

    Tielei Wang reported multiple integer overflows, possibly leading to     heap-based buffer overflows in the (1) read_png_file() and     read_png_file_as_rgb24() functions, when processing a PNG image     (CVE-2009-2295) and (2) gifread.c and jpegread.c files when processing     GIF or JPEG images (CVE-2009-2660).
    Other integer overflows were also found in tiffread.c (CVE-2009-3296).
  Impact :

    A remote attacker could entice a user to open a specially crafted,     overly large PNG, GIF, TIFF, or JPEG image using an application that     uses the CamlImages library, possibly resulting in the execution of     arbitrary code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

It was discovered that CamlImages, an open source image processing library, suffers from several integer overflows, which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. This advisory addresses issues with the reading of TIFF files. It also expands the patch for CVE-2009-2660 to cover another potential overflow in the processing of JPEG images.

Tielei Wang discovered that CamlImages, an open source image processing library, suffers from several integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. This advisory addresses issues with the reading of JPEG and GIF Images, while DSA 1832-1addressed the issue with PNG images.

ID	Name	Product	Family	Severity
46769	GLSA-201006-02 : CamlImages: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
44777	Debian DSA-1912-1 : camlimages - integer overflow	Nessus	Debian Local Security Checks	high
44722	Debian DSA-1857-1 : camlimages - integer overflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2009-2660

high

Tenable Plugins

high

high

medium