PT-2008-1135 · Imlib2 · Imlib2

Stefan Cornelius · Published 2008-06-02 · Updated 2024-06-15 · CVE-2008-2426

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Imlib2 versions 1.4.0 and earlier

Description The issue is related to multiple stack-based buffer overflows that can be triggered by user-assisted remote attacks. This can lead to a denial of service (crash) or possibly the execution of arbitrary code. The overflows are related to the load function in two specific modules: loader pnm.c for PNM images with crafted headers and loader xpm.c for crafted XPM images. Exploitation of this issue may compromise the confidentiality, integrity, and availability of protected information and can be achieved remotely.

Recommendations For Imlib2 versions 1.4.0 and earlier, consider updating to a version later than 1.4.0 to mitigate the risk of exploitation. As a temporary workaround, consider restricting the use of the load functions in loader pnm.c and loader xpm.c until a patch is available. Avoid using crafted PNM or XPM images in the affected API endpoints until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-09644

CVE-2008-2426

DSA-1594-1

OPENSUSE-SU-2024:10861-1

Affected Products

Imlib2

References · 28

• http://mandriva.com/security/advisories?name=MDVSA-2008:123 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1700 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-2426 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-2426 · Vendor Advisory
• http://secunia.com/advisories/31982 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200806-03.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2426 · Vendor Advisory
• http://secunia.com/advisories/30485 · Vendor Advisory
• http://secunia.com/advisories/30727 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2426 · Security Note
• https://bdu.fstec.ru/vul/2015-09644 · Security Note
• http://ubuntu.com/usn/USN-697-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-June/msg00052.html · Vendor Advisory
• http://secunia.com/secunia_research/2008-25/advisory · Vendor Advisory