Executive Summary

Summary
Title Imlib2: User-assisted execution of arbitrary code
Informations
Name GLSA-200812-23 First vendor Publication 2008-12-23
Vendor Gentoo Last vendor Modification 2008-12-23
Severity (Vendor) Normal Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A buffer overflow vulnerability has been discovered in Imlib2.

Background

Imlib2 is replacement library from the Enlightenment project for libraries like libXpm.

Description

Julien Danjou reported a pointer arithmetic error and a heap-based buffer overflow within the load() function of the XPM image loader.

Impact

A remote attacker could entice a user to process a specially crafted XPM image, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Imlib2 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/imlib2-1.4.2-r1"

References

[ 1 ] CVE-2008-5187 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5187

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200812-23.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200812-23.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17468
 
Oval ID: oval:org.mitre.oval:def:17468
Title: USN-683-1 -- imlib2 vulnerability
Description: It was discovered that Imlib2 did not correctly handle certain malformed XPM images.
Family: unix Class: patch
Reference(s): USN-683-1
CVE-2008-5187
 Version: 7
Platform(s): Ubuntu 6.06
Ubuntu 7.10
Ubuntu 8.04
Ubuntu 8.10
 Product(s): imlib2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18566
 
Oval ID: oval:org.mitre.oval:def:18566
Title: DSA-1672-1 imlib2 - arbitrary code execution
Description: Julien Danjou and Peter De Wachter discovered that a buffer overflow in the XPM loader of Imlib2, a powerful image loading and rendering library, might lead to arbitrary code execution.
Family: unix Class: patch
Reference(s): DSA-1672-1
CVE-2008-5187
 Version: 7
Platform(s): Debian GNU/Linux 4.0
 Product(s): imlib2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8309
 
Oval ID: oval:org.mitre.oval:def:8309
Title: DSA-1672 imlib2 -- buffer overflow
Description: Julien Danjou and Peter De Wachter discovered that a buffer overflow in the XPM loader of Imlib2, a powerful image loading and rendering library, might lead to arbitrary code execution.
Family: unix Class: patch
Reference(s): DSA-1672
CVE-2008-5187
 Version: 3
Platform(s): Debian GNU/Linux 4.0
 Product(s): imlib2
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2009-03-23 Name : Ubuntu Update for imlib2 vulnerability USN-683-1
File : nvt/gb_ubuntu_USN_683_1.nasl
2009-02-16 Name : Fedora Update for imlib2 FEDORA-2008-10287
File : nvt/gb_fedora_2008_10287_imlib2_fc9.nasl
2009-02-16 Name : Fedora Update for imlib2 FEDORA-2008-10296
File : nvt/gb_fedora_2008_10296_imlib2_fc8.nasl
2009-02-16 Name : Fedora Update for imlib2 FEDORA-2008-10364
File : nvt/gb_fedora_2008_10364_imlib2_fc10.nasl
2009-01-20 Name : Mandrake Security Advisory MDVSA-2009:019 (imlib2)
File : nvt/mdksa_2009_019.nasl
2009-01-20 Name : SuSE Security Summary SUSE-SR:2009:002
File : nvt/suse_sr_2009_002.nasl
2008-12-29 Name : Gentoo Security Advisory GLSA 200812-23 (imlib2)
File : nvt/glsa_200812_23.nasl
2008-12-03 Name : Debian Security Advisory DSA 1672-1 (imlib2)
File : nvt/deb_1672_1.nasl
2008-11-24 Name : FreeBSD Ports: imlib2, imlib2-nox11
File : nvt/freebsd_imlib21.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
49970 imlib2 XPM Loader load() Function Crafted XPM File Handling Overflow

Nessus® Vulnerability Scanner

Date Description
2011-01-27 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_imlib2-5832.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_imlib2-081121.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Fedora host is missing a security update.
File : fedora_2008-10364.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-019.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-683-1.nasl - Type : ACT_GATHER_INFO
2008-12-26 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200812-23.nasl - Type : ACT_GATHER_INFO
2008-12-02 Name : The remote openSUSE host is missing a security update.
File : suse_imlib2-5804.nasl - Type : ACT_GATHER_INFO
2008-12-01 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1672.nasl - Type : ACT_GATHER_INFO
2008-11-26 Name : The remote Fedora host is missing a security update.
File : fedora_2008-10287.nasl - Type : ACT_GATHER_INFO
2008-11-26 Name : The remote Fedora host is missing a security update.
File : fedora_2008-10296.nasl - Type : ACT_GATHER_INFO
2008-11-25 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_910486d5ba4d11dd8f230019666436c2.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:36:13
  • Multiple Updates