Multiple integer overflows in tiffread.c in CamlImages 2.2 might allow remote attackers to execute arbitrary code via TIFF images containing large width and height values that trigger heap-based buffer overflows.

The remote host is affected by the vulnerability described in GLSA-201006-02 (CamlImages: User-assisted execution of arbitrary code)

    Tielei Wang reported multiple integer overflows, possibly leading to     heap-based buffer overflows in the (1) read_png_file() and     read_png_file_as_rgb24() functions, when processing a PNG image     (CVE-2009-2295) and (2) gifread.c and jpegread.c files when processing     GIF or JPEG images (CVE-2009-2660).
    Other integer overflows were also found in tiffread.c (CVE-2009-3296).
  Impact :

    A remote attacker could entice a user to open a specially crafted,     overly large PNG, GIF, TIFF, or JPEG image using an application that     uses the CamlImages library, possibly resulting in the execution of     arbitrary code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

It was discovered that CamlImages, an open source image processing library, suffers from several integer overflows, which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. This advisory addresses issues with the reading of TIFF files. It also expands the patch for CVE-2009-2660 to cover another potential overflow in the processing of JPEG images.

Fix handling of oversized TIFF images.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
46769	GLSA-201006-02 : CamlImages: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
44777	Debian DSA-1912-1 : camlimages - integer overflow	Nessus	Debian Local Security Checks	high
42446	Fedora 11 : ocaml-camlimages-3.0.1-7.fc11.3 (2009-10594)	Nessus	Fedora Local Security Checks	high
42444	Fedora 10 : ocaml-camlimages-3.0.1-3.fc10.3 (2009-10568)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2009-3296

critical

Tenable Plugins

high

high

high

high