'imlib2' Library 'load()' Function Buffer Overflow Vulnerability

Bugtraq ID:	32371
Class:	Boundary Condition Error
CVE:	CVE-2008-5187
Remote:	Yes
Local:	No
Published:	Nov 14 2008 12:00AM
Updated:	Apr 13 2015 09:52PM
Credit:	Julien Danjou
Vulnerable:	Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise SDK 10 SuSE Suse Linux Enterprise Desktop 10 SP2 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Imlib Imlib2 1.4.2 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

'imlib2' Library 'load()' Function Buffer Overflow Vulnerability

The 'imlib2' library is prone to a buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied data.

An attacker can exploit this issue to execute arbitrary machine code in the context of applications using the vulnerable library. Failed exploit attempts will likely cause denial-of-service conditions.

This issue affects imlib2 1.4.2; other versions may also be affected.

'imlib2' Library 'load()' Function Buffer Overflow Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

'imlib2' Library 'load()' Function Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva imlib2-data-1.4.0.003-4.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2-devel-1.4.0.003-4.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-1.4.0.003-4.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-filters-1.4.0.003-4.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-loaders-1.4.0.003-4.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 7.10 powerpc

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.1_powerpc.deb


• Ubuntu libimlib2_1.3.0.0debian1-4ubuntu0.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.3.0.0 debian1-4ubuntu0.1_powerpc.deb

Mandriva Linux Mandrake 2008.1

• Mandriva imlib2-data-1.4.0.003-4.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2-devel-1.4.0.003-4.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-1.4.0.003-4.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-filters-1.4.0.003-4.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-loaders-1.4.0.003-4.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu 1.1_powerpc.deb


• Ubuntu libimlib2_1.4.0-1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.4.0-1ubuntu1.1_ powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1.1ubun tu1.1_powerpc.deb


• Ubuntu libimlib2_1.4.0-1.1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.4.0-1.1ubuntu1. 1_powerpc.deb

Debian Linux 4.0 powerpc

• Debian libimlib2_1.3.0.0debian1-4+etch2_powerpc.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_powerpc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1.1ubuntu1.1_i386.deb


• Ubuntu libimlib2_1.4.0-1.1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.4.0-1 .1ubuntu1.1_i386.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu 1.1_sparc.deb


• Ubuntu libimlib2_1.4.0-1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.4.0-1ubuntu1.1_ sparc.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.3_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.3_sparc.deb


• Ubuntu libimlib2_1.2.1-2ubuntu0.3_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2 ubuntu0.3_sparc.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva imlib2-data-1.4.0.003-2.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2-devel-1.4.0.003-2.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-1.4.0.003-2.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-filters-1.4.0.003-2.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-loaders-1.4.0.003-2.2mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1ubuntu1.1_amd64.deb


• Ubuntu libimlib2_1.4.0-1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.4.0-1 ubuntu1.1_amd64.deb

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.3_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.3_powerpc.deb


• Ubuntu libimlib2_1.2.1-2ubuntu0.3_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2 ubuntu0.3_powerpc.deb

Mandriva Linux Mandrake 2008.0

• Mandriva imlib2-data-1.4.0.003-2.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2-devel-1.4.0.003-2.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-1.4.0.003-2.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-filters-1.4.0.003-2.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-loaders-1.4.0.003-2.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 7.10 sparc

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.1_sparc.deb


• Ubuntu libimlib2_1.3.0.0debian1-4ubuntu0.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.3.0.0 debian1-4ubuntu0.1_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu 1.1_lpia.deb


• Ubuntu libimlib2_1.4.0-1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.4.0-1ubuntu1.1_ lpia.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.3_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.3_i386.deb


• Ubuntu libimlib2_1.2.1-2ubuntu0.3_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2 ubuntu0.3_i386.deb

Ubuntu Ubuntu Linux 7.10 lpia

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.3.0.0debian 1-4ubuntu0.1_lpia.deb


• Ubuntu libimlib2_1.3.0.0debian1-4ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.3.0.0debian1-4u buntu0.1_lpia.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1.1ubun tu1.1_lpia.deb


• Ubuntu libimlib2_1.4.0-1.1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.4.0-1.1ubuntu1. 1_lpia.deb

Ubuntu Ubuntu Linux 7.10 i386

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.1_i386.deb


• Ubuntu libimlib2_1.3.0.0debian1-4ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.3.0.0 debian1-4ubuntu0.1_i386.deb

Debian Linux 4.0 amd64

• Debian libimlib2_1.3.0.0debian1-4+etch2_amd64.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_amd64.deb

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu libimlib2-dev_1.2.1-2ubuntu0.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2 .1-2ubuntu0.3_amd64.deb


• Ubuntu libimlib2_1.2.1-2ubuntu0.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2 ubuntu0.3_amd64.deb

Debian Linux 4.0 ia-32

• Debian libimlib2_1.3.0.0debian1-4+etch2_i386.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_i386.deb

Debian Linux 4.0 hppa

• Debian libimlib2_1.3.0.0debian1-4+etch2_hppa.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_hppa.deb

Debian Linux 4.0 sparc

• Debian libimlib2_1.3.0.0debian1-4+etch2_sparc.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_sparc.deb

Debian Linux 4.0 s/390

• Debian libimlib2_1.3.0.0debian1-4+etch2_s390.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_s390.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1.1ubun tu1.1_sparc.deb


• Ubuntu libimlib2_1.4.0-1.1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.4.0-1.1ubuntu1. 1_sparc.deb

Mandriva Linux Mandrake 2009.0

• Mandriva imlib2-data-1.4.1.000-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2-devel-1.4.1.000-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-1.4.1.000-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-filters-1.4.1.000-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-loaders-1.4.1.000-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 alpha

• Debian libimlib2_1.3.0.0debian1-4+etch2_alpha.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_alpha.deb

Ubuntu Ubuntu Linux 7.10 amd64

• Ubuntu libimlib2-dev_1.3.0.0debian1-4ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3 .0.0debian1-4ubuntu0.1_amd64.deb


• Ubuntu libimlib2_1.3.0.0debian1-4ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.3.0.0 debian1-4ubuntu0.1_amd64.deb

MandrakeSoft Corporate Server 4.0

• Mandriva imlib2-data-1.2.1-1.5.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-1.2.1-1.5.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-devel-1.2.1-1.5.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-filters-1.2.1-1.5.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-loaders-1.2.1-1.5.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu libimlib2-dev_1.4.0-1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1ubuntu1.1_i386.deb


• Ubuntu libimlib2_1.4.0-1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.4.0-1 ubuntu1.1_i386.deb

Debian Linux 4.0 mipsel

• Debian libimlib2_1.3.0.0debian1-4+etch2_mipsel.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_mipsel.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva imlib2-data-1.4.1.000-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2-devel-1.4.1.000-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-1.4.1.000-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-filters-1.4.1.000-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-loaders-1.4.1.000-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu libimlib2-dev_1.4.0-1.1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4 .0-1.1ubuntu1.1_amd64.deb


• Ubuntu libimlib2_1.4.0-1.1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.4.0-1 .1ubuntu1.1_amd64.deb

Debian Linux 4.0 ia-64

• Debian libimlib2_1.3.0.0debian1-4+etch2_ia64.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_ia64.deb

Debian Linux 4.0 mips

• Debian libimlib2_1.3.0.0debian1-4+etch2_mips.deb
  http://security.debian.org/pool/updates/main/i/imlib2/libimlib2_1.3.0. 0debian1-4+etch2_mips.deb

MandrakeSoft Corporate Server 3.0 x86_64

• Mandriva lib64imlib2_1-1.0.6-4.6.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-devel-1.0.6-4.6.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-filters-1.0.6-4.6.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-loaders-1.0.6-4.6.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0

• Mandriva libimlib2_1-1.0.6-4.6.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-devel-1.0.6-4.6.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-filters-1.0.6-4.6.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libimlib2_1-loaders-1.0.6-4.6.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva imlib2-data-1.2.1-1.5.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-1.2.1-1.5.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-devel-1.2.1-1.5.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-filters-1.2.1-1.5.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64imlib2_1-loaders-1.2.1-1.5.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/

'imlib2' Library 'load()' Function Buffer Overflow Vulnerability

References:

• Debian Bug report logs - #505714 Crash on loading XPM file (Debian)
  
• Imlib2 Homepage (Imlib2)