M. Joonas Pihlaja

Name of the Vulnerable Software and Affected Versions: imlib2 versions prior to 1.3.0 Description: The issue is related to multiple integer overflows in imlib2, which can be exploited by user-assisted remote attackers. This can lead to a denial of service (crash) and possibly the execution of arbitrary code. The overflows are present in various image loaders, including ARGB, PNG, LBM, JPEG, and TIFF. The exploitation of these vulnerabilities can compromise the confidentiality, integrity, and availability of protected information and can be carried out remotely. Recommendations: For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable image loaders (loader argb.c, loader png.c, loader lbm.c, loader jpeg.c, loader tiff.c) until a patch is available.

Name of the Vulnerable Software and Affected Versions: imlib2 versions prior to 1.3.0 imlib2 versions prior to 1.2.1 Description: The issue allows remote attackers to cause a denial of service, potentially leading to disruption of confidentiality, integrity, and availability of protected information. This can be achieved through user-assisted exploitation, such as via a crafted TGA image that triggers an out-of-bounds memory read. Recommendations: For imlib2 versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. For imlib2 versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: imlib2 versions prior to 1.3.0 imlib2 versions prior to 1.2.1 Description: The issue is related to a heap-based buffer overflow in the loader tga.c file of imlib2, which can be exploited by remote attackers using a crafted TGA image, potentially leading to a denial of service or execution of arbitrary code. Multiple vulnerabilities in the imlib2 package can compromise the confidentiality, integrity, and availability of protected information and can be exploited remotely. Recommendations: For imlib2 versions prior to 1.2.1, update to version 1.2.1 or later. For imlib2 versions prior to 1.3.0, update to version 1.3.0 or later. As a temporary workaround, consider avoiding the use of TGA images with imlib2 until a patch is available.

Name of the Vulnerable Software and Affected Versions: imlib2 versions prior to 1.3.0 imlib2 versions prior to 1.2.1 Description: The issue is related to a stack-based buffer overflow in the loader pnm.c file of imlib2, which can be exploited by remote attackers using a crafted PNM image. This could lead to a denial of service (crash) and potentially allow the execution of arbitrary code. Additionally, there are multiple vulnerabilities in imlib2 that can compromise the confidentiality, integrity, and availability of protected information, and these can be exploited remotely. Recommendations: For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. For versions prior to 1.3.0, update to version 1.3.0 or later to address the multiple vulnerabilities.

**Name of the Vulnerable Software and Affected Versions** GraphicsMagick versions prior to 1.1.7 ImageMagick versions prior to 6.0.7 **Description** The issue is related to multiple buffer overflows that can be triggered by user-assisted attacks, potentially leading to a denial of service and possibly the execution of arbitrary code. This can occur through the processing of certain image types, specifically DCM images handled by the `ReadDCMImage` function in `coders/dcm.c`, or PALM images handled by the `ReadPALMImage` function in `coders/palm.c`. **Recommendations** For GraphicsMagick versions prior to 1.1.7, update to version 1.1.7 or later. For ImageMagick versions prior to 6.0.7, update to version 6.0.7 or later.