BID:13922

Libextractor Multiple Remote Buffer Overflow Vulnerabilities

Info

Libextractor Multiple Remote Buffer Overflow Vulnerabilities

Bugtraq ID:	13922
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2005 12:00AM
Updated:	Jun 09 2005 12:00AM
Credit:	The vendor reported these issues.
Vulnerable:	libextractor libextractor 0.4.2 libextractor libextractor 0.4.1 libextractor libextractor 0.4 libextractor libextractor 0.3.11 libextractor libextractor 0.3.10 libextractor libextractor 0.3.9 libextractor libextractor 0.3.8 libextractor libextractor 0.3.7 libextractor libextractor 0.3.6

Not Vulnerable:	libextractor libextractor 0.5

Discussion

Libextractor Multiple Remote Buffer Overflow Vulnerabilities

libextractor is affected by multiple remote buffer overflow vulnerabilities.

Specifically, these issues affect the PDF, Real and PNG extractors.

An attacker can exploit these issues by enticing a vulnerable user to open a malformed file using an application that employs libextractor.

libextractor 0.4.2 and prior versions are affected by these issues. One of these issues may related to BID 12302 (XPDF MAKEFILEKEY2 Function Remote Buffer Overflow Vulnerability).

Exploit / POC

Libextractor Multiple Remote Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Libextractor Multiple Remote Buffer Overflow Vulnerabilities

Solution:
The vendor has released libextractor 0.5.0 to address these issues.

Gentoo has released advisory GLSA 200506-06 to address these issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:

emerge --sync
emerge --ask --oneshot --verbose ">=media-libs/libextractor-0.5.0"

libextractor libextractor 0.3.10