libgdiplus for Mono File Processing Multiple Integer Overflow Vulnerabilities

Bugtraq ID:	42602
Class:	Input Validation Error
CVE:	CVE-2010-1526
Remote:	Yes
Local:	No
Published:	Aug 23 2010 12:00AM
Updated:	Apr 13 2015 08:36PM
Credit:	Stefan Cornelius of Secunia Research
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 Mono libgdiplus 2.6.7 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux
Not Vulnerable:

libgdiplus for Mono File Processing Multiple Integer Overflow Vulnerabilities

libgdiplus for Mono is prone to multiple integer-overflow vulnerabilities because it fails to properly validate user-supplied input.

Successful exploits may allow attackers to execute arbitrary code in the context of applications that use the affected library. Failed exploit attempts will likely result in denial-of-service conditions.

libgdiplus 2.6.7 is vulnerable; other versions may also be affected.

libgdiplus for Mono File Processing Multiple Integer Overflow Vulnerabilities

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

libgdiplus for Mono File Processing Multiple Integer Overflow Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu libgdiplus_2.4.2-1ubuntu0.9.10.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_2.4.2-1ub untu0.9.10.1_sparc.deb

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva lib64gdiplus-devel-2.4.2-2.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64gdiplus0-2.4.2-2.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu libgdiplus_2.4.2-1ubuntu0.10.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_2.4.2-1ub untu0.10.04.1_powerpc.deb

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva lib64gdiplus-devel-2.2-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64gdiplus0-2.2-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu libgdiplus_2.0-1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libg/libgdiplus/libgdiplus _2.0-1ubuntu0.1_i386.deb

Mandriva Linux Mandrake 2010.1

• Mandriva libgdiplus-devel-2.6.4-1.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgdiplus0-2.6.4-1.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libgdiplus_1.2.6-2ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_1.2.6-2ub untu2.1_powerpc.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu libgdiplus_2.0-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_2.0-1ubun tu0.1_lpia.deb

Mandriva Linux Mandrake 2009.0

• Mandriva libgdiplus-devel-1.9-2.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgdiplus0-1.9-2.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu libgdiplus_2.4.2-1ubuntu0.9.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libg/libgdiplus/libgdiplus _2.4.2-1ubuntu0.9.10.1_i386.deb

Ubuntu Ubuntu Linux 10.04 amd64

• Ubuntu libgdiplus_2.4.2-1ubuntu0.10.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libg/libgdiplus/libgdiplus _2.4.2-1ubuntu0.10.04.1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libgdiplus_1.2.6-2ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_1.2.6-2ub untu2.1_sparc.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva lib64gdiplus-devel-1.9-2.1mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64gdiplus0-1.9-2.1mdvmes5.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu libgdiplus_2.4.2-1ubuntu0.9.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_2.4.2-1ub untu0.9.10.1_powerpc.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu libgdiplus_2.4.2-1ubuntu0.9.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libg/libgdiplus/libgdiplus _2.4.2-1ubuntu0.9.10.1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu libgdiplus_1.2.6-2ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libg/libgdiplus/libgdiplus _1.2.6-2ubuntu2.1_i386.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64gdiplus-devel-1.9-2.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64gdiplus0-1.9-2.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu libgdiplus_1.2.6-2ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libg/libgdiplus/libgdiplus _1.2.6-2ubuntu2.1_amd64.deb

MandrakeSoft Enterprise Server 5

• Mandriva libgdiplus-devel-1.9-2.1mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgdiplus0-1.9-2.1mdvmes5.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu libgdiplus_2.4.2-1ubuntu0.9.10.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_2.4.2-1ub untu0.9.10.1_lpia.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu libgdiplus_2.0-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libg/libgdiplus/libgdiplus _2.0-1ubuntu0.1_amd64.deb

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva lib64gdiplus-devel-2.6.4-1.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64gdiplus0-2.6.4-1.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu libgdiplus_2.0-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_2.0-1ubun tu0.1_sparc.deb

Mandriva Linux Mandrake 2009.1

• Mandriva libgdiplus-devel-2.2-1.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgdiplus0-2.2-1.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.04 sparc

• Ubuntu libgdiplus_2.4.2-1ubuntu0.10.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_2.4.2-1ub untu0.10.04.1_sparc.deb

Mandriva Linux Mandrake 2010.0

• Mandriva libgdiplus-devel-2.4.2-2.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgdiplus0-2.4.2-2.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu libgdiplus_2.0-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_2.0-1ubun tu0.1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libgdiplus_1.2.6-2ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libg/libgdiplus/libgdiplus_1.2.6-2ub untu2.1_lpia.deb

Ubuntu Ubuntu Linux 10.04 i386

• Ubuntu libgdiplus_2.4.2-1ubuntu0.10.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libg/libgdiplus/libgdiplus _2.4.2-1ubuntu0.10.04.1_i386.deb

libgdiplus for Mono File Processing Multiple Integer Overflow Vulnerabilities

References:

• Libgdiplus Homepage (Mono)
  
• Secunia Research: Mono libgdiplus Image Processing Three Integer Overflows (Secunia)