PDFlib Lite PNG Image Size Integer Overflow Vulnerability

Bugtraq ID:	35266
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 08 2009 12:00AM
Updated:	Jun 12 2009 07:59PM
Credit:	Tielei Wang, ICST-ERCIS
Vulnerable:	PDFLib PDFlib Lite 7.0.4 p1
Not Vulnerable:	PDFLib PDFlib Lite 7.0.4 p4

PDFlib Lite PNG Image Size Integer Overflow Vulnerability

PDFlib Lite is prone to an integer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data before using it to allocate memory buffers.

Successful exploits will allow attacker-supplied code to run in the context of the user running the affected application. Failed attacks will result in denial-of-service conditions.

Versions prior to PDFlib Lite 7.0.4p4 are vulnerable.

PDFlib Lite PNG Image Size Integer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PDFlib Lite PNG Image Size Integer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


PDFLib PDFlib Lite 7.0.4 p1

• PDFLib PDFlib-Lite-7.0.4p4.tar.gz
  http://www.pdflib.com/binaries/PDFlib/704/PDFlib-Lite-7.0.4p4.tar.gz

PDFlib Lite PNG Image Size Integer Overflow Vulnerability

References:

• Vendor Homepage (PDFlib)