imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.

The remote host is affected by the vulnerability described in GLSA-201611-12 (imlib2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in imlib2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted image       file using an application linked against imlib2, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3075-1 advisory.

    Jakub Wilk discovered an out of bounds read in the GIF loader implementation in Imlib2. An attacker could     use this to cause a denial of service (application crash) or possibly obtain sensitive information.
    (CVE-2016-3994)

    Yuriy M. Kaminskiy discovered an off-by-one error when handling coordinates in Imlib2. An attacker could     use this to cause a denial of service (application crash). (CVE-2016-3993)

    Yuriy M. Kaminskiy discovered that integer overflows existed in Imlib2 when handling images with large     dimensions. An attacker could use this to cause a denial of service (memory exhaustion or application     crash). (CVE-2014-9771, CVE-2016-4024)

    Kevin Ryde discovered that the ellipse drawing code in Imlib2 would attempt to divide by zero when drawing     a 2x1 ellipse. An attacker could use this to cause a denial of service (application crash).
    (CVE-2011-5326)

    It was discovered that Imlib2 did not properly handled GIF images without colormaps. An attacker could use     this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and     Ubuntu 14.04 LTS. (CVE-2014-9762)

    It was discovered that Imlib2 did not properly handle some PNM images, leading to a division by zero. An     attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu     12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)

    It was discovered that Imlib2 did not properly handle error conditions when loading some GIF images. An     attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu     12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This imlib2 update to version 1.4.9 fixes the following issues :

Security issues fixed :

  - CVE-2011-5326: divide by 0 when drawing an ellipse of     height 1 (boo#974202)

  - CVE-2014-9762: segmentation fault on images without     colormap (boo#963796)

  - CVE-2014-9764: segmentation fault when opening     specifically crafted input (boo#963797)

  - CVE-2014-9763: division-by-zero crashes when opening     images (boo#963800)

  - CVE-2014-9771: exploitable integer overflow in
    _imlib_SaveImage (boo#974854)

  - CVE-2016-3994: imlib2/evas Potential DOS in giflib     loader (boo#973759)

  - CVE-2016-3993: off by 1 Potential DOS (boo#973761)

  - CVE-2016-4024: integer overflow resulting in     insufficient heap allocation (boo#975703)

Several vulnerabilities were discovered in imlib2, an image manipulation library.

  - CVE-2014-9762     A segmentation fault could occur when opening GIFs     without a colormap.

  - CVE-2014-9763     Several divisions by zero, resulting in a program crash,     could occur when handling PNM files.

  - CVE-2014-9764     A segmentation fault could occur when opening GIFs with     feh.

Rebase to version 1.4.7 Security fix for CVE-2014-9762, CVE-2014-9763, CVE-2014-9764

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Enlightenment reports :

GIF loader: Fix segv on images without colormap

Prevent division-by-zero crashes.

Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh

CVE-2014-9762 GIF loader: Fix segv on images without colormap

CVE-2014-9763 Prevent division-by-zero crashes

CVE-2014-9764 Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
95019	GLSA-201611-12 : imlib2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
93399	Ubuntu 14.04 LTS / 16.04 LTS : Imlib2 vulnerabilities (USN-3075-1)	Nessus	Ubuntu Local Security Checks	critical
91270	openSUSE Security Update : imlib2 (openSUSE-2016-600)	Nessus	SuSE Local Security Checks	critical
90280	Debian DSA-3537-1 : imlib2 - security update	Nessus	Debian Local Security Checks	high
89602	Fedora 23 : imlib2-1.4.7-1.fc23 (2016-b62d19661f)	Nessus	Fedora Local Security Checks	high
89518	Fedora 22 : imlib2-1.4.7-1.fc22 (2016-3c0b37e056)	Nessus	Fedora Local Security Checks	high
88112	FreeBSD : imlib2 -- denial of service vulnerabilities (99d3a8a5-c13c-11e5-96d6-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high
88108	Debian DLA-401-1 : imlib2 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-9762

high

Tenable Plugins

critical

critical

critical

high

high

high

high

high