[CVE-2008-2426] imlib2 PNM and XPM buffer overflows

[Till Ulen]

CVE-2008-2426 description:

"1) A boundary error exists within the "load()" function in
src/modules/loaders/loader_pnm.c when processing the header of a
PNM image file. This can be exploited to cause a stack-based buffer
overflow by e.g. tricking a user into opening a specially crafted
PNM image in an application using the imlib2 library.

[...]

2) A boundary error exists within the "load()" function in
src/modules/loader_xpm.c when processing an XPM image file. This can
be exploited to cause a stack-based buffer overflow by e.g. tricking
a user into opening a specially crafted XPM image with an application
using the imlib2 library."

http://secunia.com/secunia_research/2008-25/advisory/

[Till Ulen (tillulen)]

Debian advisory:
http://www.debian.org/security/2008/dsa-1594 (not yet available on the web site)
In the mean time, see http://lists.debian.org/debian-security-announce/2008/msg00175.html

[Sarah Kowalik (hobbsee-deactivatedaccount)]

Fixed in intrepid, marking others as needing to be fixed.

[Iain Lane (laney)]

Looking into this

[Iain Lane (laney)]

imlib2 (1.4.0-1ubuntu1.1) hardy-security; urgency=low

  * SECURITY UPDATE: Stack-based buffer overflow in pnm and xpm image loader
    modules leads to arbitrary code execution.
  * Backport patch from Intrepid to fix this issue. (LP: #235915)
  * References:
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=483816
    CVE-2008-2426

 -- Iain Lane <email address hidden> Sat, 26 Jul 2008 14:45:05 +0100

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Launchpad Janitor (janitor)]

This bug was fixed in the package imlib2 - 1.3.0.0debian1-4ubuntu0.2

---------------
imlib2 (1.3.0.0debian1-4ubuntu0.2) gutsy-security; urgency=low

  * SECURITY UPDATE: denial of service and code execution via load function
    in the XPM and PNG loaders (LP: #235915)
    - debian/patches/211_SECURITY_CVE-2008-2426.patch: add checks to make sure
      we don't overflow the buffers in XPM and PNG loaders.
    - CVE-2008-2426

 -- Marc Deslauriers <email address hidden> Thu, 18 Dec 2008 13:51:13 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package imlib2 - 1.4.0-1ubuntu1.2

---------------
imlib2 (1.4.0-1ubuntu1.2) hardy-security; urgency=low

  * SECURITY UPDATE: denial of service and code execution via load function
    in the XPM and PNG loaders (LP: #235915)
    - debian/patches/211_SECURITY_CVE-2008-2426.patch: add checks to make sure
      we don't overflow the buffers in XPM and PNG loaders.
    - CVE-2008-2426

 -- Marc Deslauriers <email address hidden> Thu, 18 Dec 2008 14:07:46 -0500

[Marc Deslauriers (mdeslaur)]

Released in USN-697-1