Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4.22, when running on Windows, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) the tiff_instantiate function processing a crafted TIFF file, (2) the png_instantiate function processing a crafted PNG file, and (3) the jpeg_instantiate function processing a crafted JPEG file, all which trigger a heap-based buffer overflow. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Specially crafted tiff, png and jpeg images could cause integer overflows in xemacs and possible system compromise. (CVE-2009-2688) Additionally two non-security bugs were fixed that enable xeamcs to use the configured fonts.

The remote host is affected by the vulnerability described in GLSA-201006-15 (XEmacs: User-assisted execution of arbitrary code)

    Tielei Wang reported multiple integer overflow vulnerabilities in the     tiff_instantiate(), png_instantiate() and jpeg_instantiate() functions     in glyphs-eimage.c, all possibly leading to heap-based buffer     overflows.
  Impact :

    A remote attacker could entice a user to open a specially crafted TIFF,     JPEG or PNG file using XEmacs, possibly resulting in the remote     execution of arbitrary code with the privileges of the user running the     application, or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Specially crafted tiff, png and jpeg images could cause integer overflows in xemacs and possible system compromise. (CVE-2009-2688) Additionally two non-security bugs were fixed that enable xemacs to use the configured fonts.

This update fixes multiple buffer overflows when reading large image files, or maliciously created image files whose headers misrepresent the actual image size.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes multiple buffer overflows when reading large image files, or maliciously created image files whose headers misrepresent the actual image size. The update also addresses multiple font issues, some of which cause warnings on startup. Some warnings remain, however, unless an ISO8859-13 fonts (e.g., terminus) is installed.
Also note that some warnings remain on Rawhide pending a resolution for bz 507637.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
51765	SuSE 10 Security Update : XEmacs (ZYPP Patch Number 6413)	Nessus	SuSE Local Security Checks	critical
46804	GLSA-201006-15 : XEmacs: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
42040	openSUSE 10 Security Update : xemacs (xemacs-6412)	Nessus	SuSE Local Security Checks	critical
41461	SuSE 11 Security Update : XEmacs (SAT Patch Number 1183)	Nessus	SuSE Local Security Checks	critical
40866	Fedora 10 : xemacs-21.5.28-10.fc10 (2009-8997)	Nessus	Fedora Local Security Checks	critical
40865	Fedora 11 : xemacs-21.5.29-2.fc11 (2009-8993)	Nessus	Fedora Local Security Checks	critical
40791	openSUSE Security Update : xemacs (xemacs-1182)	Nessus	SuSE Local Security Checks	critical
40785	openSUSE Security Update : xemacs (xemacs-1182)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2009-2688

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical