USN-3075-1

Dashboard / Vulnerabilities / USN-3075-1

USN-3075-1

Summary: imlib2 vulnerabilities

Details: Jakub Wilk discovered an out of bounds read in the GIF loader implementation in Imlib2. An attacker could use this to cause a denial of service (application crash) or possibly obtain sensitive information. (CVE-2016-3994) Yuriy M. Kaminskiy discovered an off-by-one error when handling coordinates in Imlib2. An attacker could use this to cause a denial of service (application crash). (CVE-2016-3993) Yuriy M. Kaminskiy discovered that integer overflows existed in Imlib2 when handling images with large dimensions. An attacker could use this to cause a denial of service (memory exhaustion or application crash). (CVE-2014-9771, CVE-2016-4024) Kevin Ryde discovered that the ellipse drawing code in Imlib2 would attempt to divide by zero when drawing a 2x1 ellipse. An attacker could use this to cause a denial of service (application crash). (CVE-2011-5326) It was discovered that Imlib2 did not properly handled GIF images without colormaps. An attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9762) It was discovered that Imlib2 did not properly handle some PNM images, leading to a division by zero. An attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763) It was discovered that Imlib2 did not properly handle error conditions when loading some GIF images. An attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)

References: https://ubuntu.com/security/notices/USN-3075-1, https://ubuntu.com/security/CVE-2011-5326, https://ubuntu.com/security/CVE-2014-9762, https://ubuntu.com/security/CVE-2014-9763, https://ubuntu.com/security/CVE-2014-9764, https://ubuntu.com/security/CVE-2014-9771, https://ubuntu.com/security/CVE-2016-3993, https://ubuntu.com/security/CVE-2016-3994, https://ubuntu.com/security/CVE-2016-4024