PT-2006-1075 · Enlightenment · Imlib2

M. Joonas Pihlaja · Published 2006-11-07 · Updated 2017-07-20 · CVE-2006-4806

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: imlib2 versions prior to 1.3.0

Description: The issue is related to multiple integer overflows in imlib2, which can be exploited by user-assisted remote attackers. This can lead to a denial of service (crash) and possibly the execution of arbitrary code. The overflows are present in various image loaders, including ARGB, PNG, LBM, JPEG, and TIFF. The exploitation of these vulnerabilities can compromise the confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations: For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable image loaders (loader argb.c, loader png.c, loader lbm.c, loader jpeg.c, loader tiff.c) until a patch is available.

Fix

Related Identifiers

BDU:2015-09534

CVE-2006-4806

Affected Products

Imlib2

References · 25

• http://novell.com/linux/security/advisories/2006_26_sr.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200612-20.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4806 · Vendor Advisory
• http://secunia.com/advisories/22752 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:198 · Vendor Advisory
• http://secunia.com/advisories/22744 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-4806 · Vendor Advisory
• http://ubuntu.com/usn/usn-376-1 · Vendor Advisory
• http://secunia.com/advisories/22732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4806 · Security Note
• https://bdu.fstec.ru/vul/2015-09534 · Security Note
• https://osv.dev/vulnerability/CVE-2006-4806 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:156 · Vendor Advisory
• http://secunia.com/advisories/22932 · Note
• http://ubuntu.com/usn/usn-376-2 · Patch, Vendor Advisory