PT-2009-5083 · Xemacs · Xemacs

Tielei Wang · Publicado 2009-08-05 · Atualizado 2017-08-17 · CVE-2009-2688

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XEmacs version 21.4.22

Description The issue is related to multiple integer overflows in the glyphs-eimage.c file of XEmacs, specifically when running on Windows. These overflows can be triggered by processing crafted image files, including TIFF, PNG, and JPEG files, through the tiff instantiate, png instantiate, and jpeg instantiate functions, respectively. This can lead to a denial of service (crash) or potentially allow remote attackers to execute arbitrary code due to a heap-based buffer overflow.

Recommendations For XEmacs version 21.4.22, consider avoiding the use of the tiff instantiate, png instantiate, and jpeg instantiate functions until a patch is available, or restrict the processing of TIFF, PNG, and JPEG files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2009-2688

Produtos afetados

Xemacs

Referências · 14

• https://security-tracker.debian.org/tracker/CVE-2009-2688 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51333 · Nota
• http://tracker.xemacs.org/XEmacs/its/issue534 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2688 · Aviso do Fabricante
• http://osvdb.org/55298 · Nota
• http://securityfocus.com/bid/35473 · Nota
• https://osv.dev/vulnerability/CVE-2009-2688 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51334 · Nota
• http://secunia.com/advisories/35348 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51332 · Nota
• http://vupen.com/english/advisories/2009/1666 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=511994 · Nota
• https://bugs.gentoo.org/show_bug.cgi?id=275397 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2688 · Nota de Segurança