Multiple heap buffer overflows caused by int overflow

[Kai Dietrich]

The CImg library uses an unsafe pattern to calculate memory allocations size. At least in the PNM file format parser, an attacker can trivially supply width/height fields that overflow the heap and result in arbitrary heap writes. This probably also affects other file format parsers in CImg.

The most prominent user of CImg is gmic.
The gmic commandline tool directly exposes the load_pnm() functions (and also the other file format load functions) to the user and thus is affected.

The issue is public and fixed in:
https://github.com/dtschump/CImg/pull/295

Redhat bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1892577
https://bugzilla.redhat.com/show_bug.cgi?id=1893377

[Kai Dietrich (0cs935kb517wwm-mail)]

No CVE assigned yet AFAIK.

[Eduardo Barretto (ebarretto)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures