PT-2007-7485 · Tcl/Tk+2 · Tcl+4

Schelte Bron · Published 1970-01-01 · Updated 2018-10-15 · CVE-2007-5378

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions tk8.4-dev versions 8.4.12 and earlier tcl-devel-8.3.5 version 8.3.5 tclx-8.3 version 8.3 tk8.4 versions 8.4.12 and earlier libtk-img-doc (affected versions not specified) tcllib-1.0 (affected versions not specified) tk8.4-doc (affected versions not specified) tcltk-8.3.3 version 8.3.3 libtk-img (affected versions not specified) tcl-8.3.3 version 8.3.3 tcltk-8.3.5 version 8.3.5 libtk-img-dev (affected versions not specified) tcl-8.3.5 version 8.3.5

Description The issue involves multiple vulnerabilities in various packages of Debian GNU/Linux and Red Hat Enterprise Linux operating systems. These vulnerabilities can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be carried out remotely. A specific vulnerability is a buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, which allows user-assisted attackers to cause a denial of service via an animated GIF.

Recommendations For tk8.4-dev versions 8.4.12 and earlier, update to a version later than 8.4.12. For tcl-devel-8.3.5 version 8.3.5, update to a version later than 8.3.5. For tclx-8.3 version 8.3, update to a version later than 8.3. For tk8.4 versions 8.4.12 and earlier, update to a version later than 8.4.12. For libtk-img-doc, tcllib-1.0, tk8.4-doc, libtk-img, and libtk-img-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For tcltk-8.3.3 version 8.3.3, update to a version later than 8.3.3. For tcl-8.3.3 version 8.3.3, update to a version later than 8.3.3. For tcltk-8.3.5 version 8.3.5, update to a version later than 8.3.5. For tcl-8.3.5 version 8.3.5, update to a version later than 8.3.5.

DoS

Buffer Overflow

Weakness Enumeration

CWE-399

CWE-119

Related Identifiers

BDU:2015-01936

BDU:2015-01937

BDU:2015-01938

BDU:2015-03138

BDU:2015-03139

BDU:2015-03140

BDU:2015-06549

BDU:2015-06550

BDU:2015-06551

BDU:2015-06552

BDU:2015-06553

BDU:2015-06554

BDU:2015-06555

CVE-2007-5378

DSA-1415-1

DSA-1416-1

DSA-1743-1

RHSA-2008:0134

RHSA-2008:0135

RHSA-2008_0135

Affected Products

Debian

Red Hat

Tcl

Tk

Tk Toolkit

References · 53

• http://debian.org/security/2007/dsa-1416 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06550 · Security Note
• https://bdu.fstec.ru/vul/2015-03138 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-5378 · Security Note
• https://bdu.fstec.ru/vul/2015-01938 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-5378 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03442 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5137 · Security Note
• https://bdu.fstec.ru/vul/2015-01936 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-5378 · Vendor Advisory
• http://debian.org/security/2007/dsa-1415 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06551 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0134.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06555 · Security Note
• http://debian.org/security/2009/dsa-1743 · Vendor Advisory