PT-2004-3667 · Imlib · Imlib

Pavel Kankovsky · Published 1970-01-01 · Updated 2017-10-11 · CVE-2004-1026

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions imlib versions 1.9.13 and earlier imlib versions 1.9.14 and earlier

Description The issue involves multiple vulnerabilities in the imlib package, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially allowing attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files.

Recommendations For imlib versions 1.9.13 and earlier, update to a version later than 1.9.13 to resolve the issue. For imlib versions 1.9.14 and earlier, update to a version later than 1.9.14 to resolve the issue. As a temporary workaround, consider restricting the use of image files from untrusted sources to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-02024

BDU:2015-02025

BDU:2015-06206

BDU:2015-06207

BDU:2015-06208

CVE-2004-1026

DSA-618-1

DSA-628-1

RHSA-2004:651

Affected Products

Imlib

References · 20

• http://securityfocus.com/bid/11830 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06208 · Security Note
• http://redhat.com/support/errata/RHSA-2004-651.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06207 · Security Note
• https://osv.dev/vulnerability/CVE-2004-1026 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02024 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1025 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1026 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2005:007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1026 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-1026 · Vendor Advisory
• http://debian.org/security/2005/dsa-628 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200412-03.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-1026 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02025 · Security Note