imlib: Vulnerable to GLSA 200412-03?
Bug #11118 reported by
Debian Bug Importer
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Debian |
Fix Released
|
Unknown
|
|||
Ubuntu |
Invalid
|
High
|
Martin Pitt |
Bug Description
Automatically imported from Debian bug report #285138 http://
To post a comment you must log in.
Message-ID: <email address hidden>
Date: Thu, 9 Dec 2004 15:51:07 +0100
From: Andreas Metzler <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: imlib: Vulnerable to GLSA 200412-03?
Package: imlib,imlib+png2
Severity: normal
Tags: security,patch
Hello, ------- ------- www.gentoo. org/security/ en/glsa/ glsa-200412- 03.xml
-------
http://
Synopsis
Multiple overflows have been found in the imlib library image decoding
routines, potentially allowing execution of arbitrary code.
2. Impact Information
Background
imlib is an advanced replacement library for image manipulation libraries like
libXpm. It is called by numerous programs, including gkrellm and several window
managers, to help in displaying images.
Description
Pavel Kankovsky discovered that several overflows found in the libXpm library
(see GLSA 200409-34) also applied to imlib. He also fixed a number of other
potential flaws.
Impact
A remote attacker could entice a user to view a carefully-crafted image file, ------- -------
which would potentially lead to execution of arbitrary code with the rights of
the user viewing the image. This affects any program that makes use of the
imlib library.
[...]
-------
Links: /bugzilla. redhat. com/bugzilla/ show_bug. cgi?id= 138516 /bugzilla. fedora. us/show_ bug.cgi? id=2051# c11 gd.tuwien. ac.at/platform/ Linux/gentoo- portage/ media-libs/ imlib/files/ imlib-1. 9.14-sec2. patch
https:/
https:/
Patch:
http://
(does apply cleanly to imlib 1.9.14-17 and imlib+png2 1.9.14-16.)
I am submitting as normal because the given exploit scary.beasts. org/misc/ doom.xpm) does not work for me, and I'd
(http://
rather not use an inflated severity.
cu andreas
--
"See, I told you they'd listen to Reason," [SPOILER] Svfurlr fnlf,
fuhggvat qbja gur juveyvat tha.
Neal Stephenson in "Snow Crash"