Multiple integer overflows in imlib2 allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) ARGB (loader_argb.c), (2) PNG (loader_png.c), (3) LBM (loader_lbm.c), (4) JPEG (loader_jpeg.c), or (5) TIFF (loader_tiff.c) images.

M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the validity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images. If a user were tricked into viewing or processing a specially crafted image with an application that uses imlib2, the flaws could be exploited to execute arbitrary code with the user's privileges.

Fedora Extras versions earlier then the versions mentioned above are vulnerable to this problem, upgrade to fix this vulnerability.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

M Joonas Pihlaja discovered several vulnerabilities in the Imlib2 graphics library.

The load() function of several of the Imlib2 image loaders does not check the width and height of an image before allocating memory. As a result, a carefully crafted image file can trigger a segfault when an application using Imlib2 attempts to view the image. (CVE-2006-4806)

The tga loader fails to bounds check input data to make sure the input data doesn load outside the memory mapped region. (CVE-2006-4807)

The RLE decoding loops of the load() function in the tga loader does not check that the count byte of an RLE packet doesn cause a heap overflow of the pixel buffer. (CVE-2006-4808)

The load() function of the pnm loader writes arbitrary length user data into a fixed size stack allocated buffer buf[] without bounds checking. (CVE-2006-4809)

Updated packages have been patched to prevent these issues.

Various security problems have been fixed in the imlib2 image loaders :

  - A stack-based buffer overflow in loader_pnm.c could be     used by attackers to execute code by supplying a     handcrafted PNM image. (CVE-2006-4809)

  - A heap buffer overflow in loader_tga.c could potentially     be used by attackers to execute code by supplying a     handcrafted TGA image. (CVE-2006-4808)

  - A out of bounds memory read in loader_tga.c could be     used to crash the imlib2 using application with a     handcrafted TGA image. (CVE-2006-4807)

  - Various integer overflows in width*height calculations     could lead to heap overflows which could potentially be     used to execute code. Affected here are the ARGB, PNG,     LBM, JPEG and TIFF loaders. (CVE-2006-4806)

Additionally loading of TIFF images on 64bit systems now works.

This obsoletes a previous update, which had broken JPEG loading.

Various security problems have been fixed in the imlib2 image loaders :

  - A stack-based buffer overflow in loader_pnm.c could be     used by attackers to execute code by supplying a     handcrafted PNM image. (CVE-2006-4809)

  - A heap buffer overflow in loader_tga.c could potentially     be used by attackers to execute code by supplying a     handcrafted TGA image. (CVE-2006-4808)

  - A out of bounds memory read in loader_tga.c could be     used to crash the imlib2 using application with a     handcrafted TGA image. (CVE-2006-4807)

  - Various integer overflows in width*height calculations     could lead to heap overflows which could potentially be     used to execute code. Affected here are the ARGB, PNG,     LBM, JPEG and TIFF loaders. (CVE-2006-4806)

Additionally loading of TIFF images on 64bit systems now works.

M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the validity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images. If a user were tricked into viewing or processing a specially crafted image with an application that uses imlib2, the flaws could be exploited to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various security problems have been fixed in the imlib2 image loaders :

CVE-2006-4809: A stack-based buffer overflow in loader_pnm.c could be used by attackers to execute code by supplying a handcrafted PNM image.

CVE-2006-4808: A heap buffer overflow in loader_tga.c could potentially be used by attackers to execute code by supplying a handcrafted TGA image.

CVE-2006-4807: A out of bounds memory read in loader_tga.c could be used to crash the imlib2 using application with a handcrafted TGA image.

CVE-2006-4806: Various integer overflows in width*height calculations could lead to heap overflows which could potentially be used to execute code. Affected here are the ARGB, PNG, LBM, JPEG and TIFF loaders.

Additionaly loading of TIFF images on 64bit systems is now possible.

This update obsoletes the previous one, which had problems with JPEG loading.

Various security problems have been fixed in the imlib2 image loaders :

CVE-2006-4809: A stack-based buffer overflow in loader_pnm.c could be used by attackers to execute code by supplying a handcrafted PNM image.

CVE-2006-4808: A heap buffer overflow in loader_tga.c could potentially be used by attackers to execute code by supplying a handcrafted TGA image.

CVE-2006-4807: A out of bounds memory read in loader_tga.c could be used to crash the imlib2 using application with a handcrafted TGA image.

CVE-2006-4806: Various integer overflows in width*height calculations could lead to heap overflows which could potentially be used to execute code. Affected here are the ARGB, PNG, LBM, JPEG and TIFF loaders.

Additionaly loading of TIFF images on 64bit systems is now possible.

M Joonas Pihlaja discovered several vulnerabilities in the Imlib2 graphics library.

The load() function of several of the Imlib2 image loaders does not check the width and height of an image before allocating memory. As a result, a carefully crafted image file can trigger a segfault when an application using Imlib2 attempts to view the image. (CVE-2006-4806)

The tga loader fails to bounds check input data to make sure the input data doesn't load outside the memory mapped region. (CVE-2006-4807)

The RLE decoding loops of the load() function in the tga loader does not check that the count byte of an RLE packet doesn't cause a heap overflow of the pixel buffer. (CVE-2006-4808)

The load() function of the pnm loader writes arbitrary length user data into a fixed size stack allocated buffer buf[] without bounds checking. (CVE-2006-4809) Updated packages have been patched to correct these issues.

Update :

An error in the previous patchset may affect JPEG image handling for certain valid images. This new update corrects this issue.

The remote host is affected by the vulnerability described in GLSA-200612-20 (imlib2: Multiple vulnerabilities)

    M. Joonas Pihlaja discovered several buffer overflows in loader_argb.c,     loader_png.c, loader_lbm.c, loader_jpeg.c, loader_tiff.c, loader_tga.c,     loader_pnm.c and an out-of-bounds memory read access in loader_tga.c.
  Impact :

    An attacker can entice a user to process a specially crafted JPG, ARGB,     PNG, LBM, PNM, TIFF, or TGA image with an 'imlib2*' binary or another     application using the imlib2 libraries. Successful exploitation of the     buffer overflows causes the execution of arbitrary code with the     permissions of the user running the application.
  Workaround :

    There is no known workaround at this time.

Secunia reports :

Some vulnerabilities have been reported in imlib2, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library.

The vulnerabilities are caused due to unspecified errors within the processing of JPG, ARGB, PNG, LBM, PNM, TIFF, and TGA images. This may be exploited to execute arbitrary code by e.g. tricking a user into opening a specially crafted image file with an application using imlib2.

ID	Name	Product	Family	Severity
62278	Fedora Extras : imlib2-1.2.1-2 (2006-004)	Nessus	Fedora Local Security Checks	medium
37033	Mandrake Linux Security Advisory : imlib2 (MDKSA-2007:156)	Nessus	Mandriva Local Security Checks	medium
29464	SuSE 10 Security Update : imlib2-loaders (ZYPP Patch Number 2261)	Nessus	SuSE Local Security Checks	medium
29463	SuSE 10 Security Update : imlib2-loaders (ZYPP Patch Number 2245)	Nessus	SuSE Local Security Checks	medium
27957	Ubuntu 5.10 / 6.06 LTS / 6.10 : imlib2 vulnerabilities (USN-376-1)	Nessus	Ubuntu Local Security Checks	medium
27271	openSUSE 10 Security Update : imlib2-loaders (imlib2-loaders-2265)	Nessus	SuSE Local Security Checks	medium
27270	openSUSE 10 Security Update : imlib2-loaders (imlib2-loaders-2244)	Nessus	SuSE Local Security Checks	medium
24583	Mandrake Linux Security Advisory : imlib2 (MDKSA-2006:198-1)	Nessus	Mandriva Local Security Checks	medium
23957	GLSA-200612-20 : imlib2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
23665	FreeBSD : Imlib2 -- multiple image file processing vulnerabilities (92442c4b-6f4a-11db-bd28-0012f06707f0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2006-4806

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium