PT-2008-6942 · Tcl/Tk+2 · Tcltk+10

Tomas Hoger · Published 1970-01-01 · Updated 2024-07-05 · CVE-2008-0553

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tk versions prior to 8.5.1 tcl-devel versions 8.3.5 and earlier tclx versions 8.3 and earlier tk8.3 versions prior to 8.5.1 tk8.3-dev versions prior to 8.5.1 tcllib versions 1.0 and earlier tcltk versions 8.3.3 and earlier, 8.3.5 and earlier tk8.3-doc versions prior to 8.5.1 tcl versions 8.3.3 and earlier, 8.3.5 and earlier

Description The issue involves multiple vulnerabilities in the Tk package, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. A specific vulnerability is a stack-based buffer overflow in the ReadImage function in tkImgGIF.c in Tk (Tcl/Tk) before 8.5.1, allowing remote attackers to execute arbitrary code via a crafted GIF image.

Recommendations For Tk versions prior to 8.5.1, update to version 8.5.1 or later. For tcl-devel versions 8.3.5 and earlier, update to a version later than 8.3.5. For tclx versions 8.3 and earlier, update to a version later than 8.3. For tk8.3 versions prior to 8.5.1, update to version 8.5.1 or later. For tk8.3-dev versions prior to 8.5.1, update to version 8.5.1 or later. For tcllib versions 1.0 and earlier, update to a version later than 1.0. For tcltk versions 8.3.3 and earlier, 8.3.5 and earlier, update to a version later than 8.3.5. For tk8.3-doc versions prior to 8.5.1, update to version 8.5.1 or later. For tcl versions 8.3.3 and earlier, 8.3.5 and earlier, update to a version later than 8.3.5. As a temporary workaround, consider disabling the ReadImage function in tkImgGIF.c until a patch is available. Restrict access to the vulnerable tkImgGIF.c module to minimize the risk of exploitation. Avoid using crafted GIF images in the affected API endpoint until the issue is resolved.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-399

CWE-119

Related Identifiers

ALT-PU-2017-1441

ALT-PU-2024-9046

BDU:2015-03440

BDU:2015-03441

BDU:2015-03442

BDU:2015-06549

BDU:2015-06550

BDU:2015-06551

BDU:2015-06552

BDU:2015-06553

BDU:2015-06554

BDU:2015-06555

CVE-2008-0553

DSA-1490-1

DSA-1491-1

DSA-1598-1

DTSA-140-1

OPENSUSE-SU-2024:10392-1

RHSA-2008:0134

RHSA-2008:0135

RHSA-2008:0136

RHSA-2008_0135

RHSA-2008_0136

Affected Products

Alt Linux

Red Hat

Tk

Tcl

Tcl-Devel

Tcllib

Tcltk

Tclx

Tk8.3

Tk8.3-Dev

Tk8.3-Doc

References · 87

• http://mandriva.com/security/advisories?name=MDVSA-2008:041 · Vendor Advisory
• http://securityfocus.com/bid/27655 · Patch
• http://secunia.com/advisories/30717 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00193.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0553 · Security Note
• https://bdu.fstec.ru/vul/2015-01938 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00115.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-0553 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2877 · Security Note
• http://ubuntu.com/usn/usn-664-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html · Vendor Advisory
• http://secunia.com/advisories/28867 · Vendor Advisory
• http://secunia.com/advisories/29070 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6067 · Security Note
• https://bdu.fstec.ru/vul/2015-06552 · Security Note