PT-2009-1554 · Enlightenment Foundation Libraries · Imlib2

Published 2009-02-06 · Updated 2017-08-08 · CVE-2008-6079

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions imlib2 versions prior to 1.4.2

Description The issue allows context-dependent attackers to have an unspecified impact via a crafted file, including ARGB, BMP, JPEG, LBM, PNM, TGA, or XPM files. This is related to several heap and stack-based buffer overflows, partly due to integer overflows.

Recommendations For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider restricting the processing of crafted files until a patch is available. Avoid using the vulnerable functions related to the processing of ARGB, BMP, JPEG, LBM, PNM, TGA, or XPM files in imlib2 until the issue is resolved.

Fix

Related Identifiers

CVE-2008-6079

DSA-2029-1

Affected Products

Imlib2

References · 13

• http://secunia.com/advisories/32354 · Vendor Advisory
• http://debian.org/security/2010/dsa-2029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6079 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2008-6079 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-6079 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-6079 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46037 · Note
• http://vupen.com/english/advisories/2008/2898 · Note
• http://vupen.com/english/advisories/2010/0803 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576469 · Note
• http://secunia.com/advisories/39340 · Note
• http://securityfocus.com/bid/31880 · Note
• http://sourceforge.net/project/shownotes.php?release_id=634778 · Note