PT-2007-7485 · Tcl/Tk+2 · Tcl+4

Schelte Bron

·

Publicado

1970-01-01

·

Atualizado

2018-10-15

·

CVE-2007-5378

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions tk8.4-dev versions 8.4.12 and earlier tcl-devel-8.3.5 version 8.3.5 tclx-8.3 version 8.3 tk8.4 versions 8.4.12 and earlier libtk-img-doc (affected versions not specified) tcllib-1.0 (affected versions not specified) tk8.4-doc (affected versions not specified) tcltk-8.3.3 version 8.3.3 libtk-img (affected versions not specified) tcl-8.3.3 version 8.3.3 tcltk-8.3.5 version 8.3.5 libtk-img-dev (affected versions not specified) tcl-8.3.5 version 8.3.5
Description The issue involves multiple vulnerabilities in various packages of Debian GNU/Linux and Red Hat Enterprise Linux operating systems. These vulnerabilities can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be carried out remotely. A specific vulnerability is a buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, which allows user-assisted attackers to cause a denial of service via an animated GIF.
Recommendations For tk8.4-dev versions 8.4.12 and earlier, update to a version later than 8.4.12. For tcl-devel-8.3.5 version 8.3.5, update to a version later than 8.3.5. For tclx-8.3 version 8.3, update to a version later than 8.3. For tk8.4 versions 8.4.12 and earlier, update to a version later than 8.4.12. For libtk-img-doc, tcllib-1.0, tk8.4-doc, libtk-img, and libtk-img-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For tcltk-8.3.3 version 8.3.3, update to a version later than 8.3.3. For tcl-8.3.3 version 8.3.3, update to a version later than 8.3.3. For tcltk-8.3.5 version 8.3.5, update to a version later than 8.3.5. For tcl-8.3.5 version 8.3.5, update to a version later than 8.3.5.

DoS

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-399CWE-119

Identificadores relacionados

BDU:2015-01936
BDU:2015-01937
BDU:2015-01938
BDU:2015-03138
BDU:2015-03139
BDU:2015-03140
BDU:2015-06549
BDU:2015-06550
BDU:2015-06551
BDU:2015-06552
BDU:2015-06553
BDU:2015-06554
BDU:2015-06555
CVE-2007-5378
DSA-1415-1
DSA-1416-1
DSA-1743-1
RHSA-2008:0134
RHSA-2008:0135
RHSA-2008_0135

Produtos afetados

Debian
Red Hat
Tcl
Tk
Tk Toolkit