Multiple integer overflows in CamlImages 2.2 and earlier might allow context-dependent attackers to execute arbitrary code via a crafted PNG image with large width and height values that trigger a heap-based buffer overflow in the (1) read_png_file or (2) read_png_file_as_rgb24 function.

The remote host is affected by the vulnerability described in GLSA-201006-02 (CamlImages: User-assisted execution of arbitrary code)

    Tielei Wang reported multiple integer overflows, possibly leading to     heap-based buffer overflows in the (1) read_png_file() and     read_png_file_as_rgb24() functions, when processing a PNG image     (CVE-2009-2295) and (2) gifread.c and jpegread.c files when processing     GIF or JPEG images (CVE-2009-2660).
    Other integer overflows were also found in tiffread.c (CVE-2009-3296).
  Impact :

    A remote attacker could entice a user to open a specially crafted,     overly large PNG, GIF, TIFF, or JPEG image using an application that     uses the CamlImages library, possibly resulting in the execution of     arbitrary code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Tielei Wang discovered that CamlImages, an open source image processing library, suffers from several integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution.

- Fri Jul 3 2009 Richard W.M. Jones <rjones at redhat.com>
    - 3.0.1-3.fc10.2

    - ocaml-camlimages: PNG reader multiple integer       overflows (CVE-2009-2295 / RHBZ#509531).

  - Mon Nov 3 2008 Richard W.M. Jones <rjones at redhat.com>
    - 3.0.1-3

    - +BR gtk2-devel.

    - +BR ocaml-x11.

    - Mon Nov 3 2008 Richard W.M. Jones <rjones at       redhat.com> - 3.0.1-1

    - Home page moved (fixes rhbz 468158).

    - New upstream version 3.0.1 and multiple build fixes       for this.

    - License is really LGPLv2 with the OCaml linking       exception.

    - Removed the DESTDIR patch.

    - Build tiff support.

    - Run it through rpmlint and fix all problems.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes :

  - Bug #509531 - CVE-2009-2295 ocaml-camlimages: PNG reader     multiple integer overflows (oCERT-2009-009)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
46769	GLSA-201006-02 : CamlImages: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
44697	Debian DSA-1832-1 : camlimages - integer overflow	Nessus	Debian Local Security Checks	high
40948	Fedora 10 : ocaml-camlimages-3.0.1-3.fc10.2 (2009-7491)	Nessus	Fedora Local Security Checks	high
40580	Fedora 11 : ocaml-camlimages-3.0.1-7.fc11.2 (2009-7494)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2009-2295

high

Tenable Plugins

high

high

high

high