'imlib2' Library Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	29417
Class:	Boundary Condition Error
CVE:	CVE-2008-2426
Remote:	Yes
Local:	No
Published:	May 29 2008 12:00AM
Updated:	Dec 30 2008 05:22PM
Credit:	Stefan Cornelius, Secunia Research.
Vulnerable:	Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Gentoo Linux Enlightenment Imlib2 1.4 Enlightenment Imlib2 1.3 + Redhat Fedora 7 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

'imlib2' Library Multiple Buffer Overflow Vulnerabilities

The 'imlib2' library is prone to multiple buffer-overflow vulnerabilities because the software fails to properly bounds-check user-supplied data.

An attacker can exploit these issues to execute arbitrary machine code in the context of applications using the vulnerable library. Failed exploit attempts will likely cause denial-of-service conditions.

The issues affect imlib2 1.4.0; other versions may also be affected.

'imlib2' Library Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

'imlib2' Library Multiple Buffer Overflow Vulnerabilities

Solution:
Vendor fixes are available. Please see the references for more information.


Ubuntu Ubuntu Linux 7.10 powerpc

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.1_powerpc.deb


• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.2_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu 1.1_powerpc.deb


• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu 1.2_powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1.1ubun tu1.1_powerpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1.1ubuntu1.1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu 1.1_sparc.deb


• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu 1.2_sparc.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.3_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.3_sparc.deb


• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.4_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1ubuntu1.1_amd64.deb


• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1ubuntu1.2_amd64.deb

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.3_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.3_powerpc.deb


• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.4_powerpc.deb

Ubuntu Ubuntu Linux 7.10 sparc

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.1_sparc.deb


• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.2_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu 1.1_lpia.deb


• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu 1.2_lpia.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.3_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.3_i386.deb


• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.4_i386.deb

Ubuntu Ubuntu Linux 7.10 lpia

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.3.0.0debian 1-4ubuntu0.1_lpia.deb


• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.3.0.0debian 1-4ubuntu0.2_lpia.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1.1ubun tu1.1_lpia.deb

Ubuntu Ubuntu Linux 7.10 i386

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.1_i386.deb


• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.2_i386.deb

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.3_amd64.deb


• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.4_amd64.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1.1ubun tu1.1_sparc.deb

Ubuntu Ubuntu Linux 7.10 amd64

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.1_amd64.deb


• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.2_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1ubuntu1.1_i386.deb


• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1ubuntu1.2_i386.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1.1ubuntu1.1_amd64.deb

'imlib2' Library Multiple Buffer Overflow Vulnerabilities

References:

• Vendor Home Page (Enlightenment)
  
• Secunia Research: imlib2 PNM and XPM Buffer Overflow (Secunia Research )
  
• Secunia Research: imlib2 PNM and XPM Buffer Overflows (Secunia Research)