PT-2002-3164 · Unknown · Windowmaker+1

Published 1970-01-01 · Updated 2008-09-05 · CVE-2002-1277

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Window Maker versions 0.80.0 and earlier WindowMaker version 0.64.0 WindowMaker version 0.61.1 WindowMaker-libs version 0.64.0

Description The issue is related to a buffer overflow in Window Maker that may allow remote attackers to execute arbitrary code via a certain image file. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.

Recommendations For Window Maker versions 0.80.0 and earlier, consider updating to a newer version to mitigate the risk. For WindowMaker version 0.64.0, restrict access to the vulnerable module to minimize the risk of exploitation. For WindowMaker version 0.61.1, avoid using the vulnerable function until a patch is available. For WindowMaker-libs version 0.64.0, disable the vulnerable library until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability in libwraster2 and libwraster2-dev packages.

Fix

Related Identifiers

BDU:2015-02939

BDU:2015-02940

BDU:2015-07918

BDU:2015-07919

BDU:2015-07920

CVE-2002-1277

DSA-190

Affected Products

Windowmaker

Windowmaker-Libs

References · 19

• https://osv.dev/vulnerability/CVE-2002-1277 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-043.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1277 · Security Note
• https://bdu.fstec.ru/vul/2015-07918 · Security Note
• https://bdu.fstec.ru/vul/2015-02940 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1277 · Security Note
• https://bdu.fstec.ru/vul/2015-07920 · Security Note
• http://redhat.com/support/errata/RHSA-2003-009.html · Vendor Advisory
• http://iss.net/security_center/static/10560.php · Vendor Advisory
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-085.php · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-1277 · Vendor Advisory
• http://debian.org/security/2002/dsa-190 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-1277 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02939 · Security Note