Multiple vulnerabilities have been found in imlib2, the worst of which allows for the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/imlib2 | * | < 1.4.9 | >= 1.4.9 |
imlib2 is an advanced replacement for image manipulation libraries such as libXpm. It is utilized by numerous programs, including gkrellm and several window managers, to display images.
Multiple vulnerabilities have been discovered in imlib2. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted image file using an application linked against imlib2, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All imlib2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/imlib2-1.4.9"
A buffer overflow vulnerability has been discovered in Imlib2.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/imlib2 | * | < 1.4.2-r1 | >= 1.4.2-r1 |
Imlib2 is replacement library from the Enlightenment project for libraries like libXpm.
Julien Danjou reported a pointer arithmetic error and a heap-based buffer overflow within the load() function of the XPM image loader.
A remote attacker could entice a user to process a specially crafted XPM image, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or a Denial of Service.
There is no known workaround at this time.
All Imlib2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/imlib2-1.4.2-r1"
Two vulnerabilities in Imlib 2 may allow for the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/imlib2 | * | < 1.4.0-r1 | >= 1.4.0-r1 |
Imlib 2 is an advanced replacement library for libraries like libXpm.
Stefan Cornelius (Secunia Research) reported two boundary errors in Imlib2:
A remote attacker could entice a user to open a specially crafted PNM or XPM image, possibly resulting in the execution of arbitrary code with the rights of the user running the application using Imlib 2.
There is no known workaround at this time.
All Imlib 2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/imlib2-1.4.0-r1"
imlib2 contains several vulnerabilities that could lead to the remote execution of arbitrary code or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/imlib2 | * | < 1.3.0 | >= 1.3.0 |
imlib2 is an advanced replacement for image manipulation libraries such as libXpm. It is utilized by numerous programs, including gkrellm and several window managers, to display images.
M. Joonas Pihlaja discovered several buffer overflows in loader_argb.c, loader_png.c, loader_lbm.c, loader_jpeg.c, loader_tiff.c, loader_tga.c, loader_pnm.c and an out-of-bounds memory read access in loader_tga.c.
An attacker can entice a user to process a specially crafted JPG, ARGB, PNG, LBM, PNM, TIFF, or TGA image with an "imlib2*" binary or another application using the imlib2 libraries. Successful exploitation of the buffer overflows causes the execution of arbitrary code with the permissions of the user running the application.
There is no known workaround at this time.
All imlib2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/imlib2-1.3.0"
Multiple overflows have been found in the imlib2 library image decoding routines, potentially allowing the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/imlib2 | * | < 1.2.0 | >= 1.2.0 |
imlib2 is an advanced replacement for image manipulation libraries such as libXpm. It is utilized by numerous programs, including gkrellm and several window managers, to display images.
Pavel Kankovsky discovered that several buffer overflows found in the libXpm library (see GLSA 200409-34) also apply to imlib (see GLSA 200412-03) and imlib2. He also fixed a number of other potential security vulnerabilities.
A remote attacker could entice a user to view a carefully-crafted image file, which would potentially lead to the execution of arbitrary code with the rights of the user viewing the image. This affects any program that utilizes of the imlib2 library.
There is no known workaround at this time.
All imlib2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/imlib2-1.2.0"
ImageMagick, imlib and imlib2 contain exploitable buffer overflow vulnerabilities in the BMP image processing code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/imagemagick | * | < 6.0.7.1 | >= 6.0.7.1 |
| media-libs/imlib | * | < 1.9.14-r2 | >= 1.9.14-r2 |
| media-libs/imlib2 | * | < 1.1.2 | >= 1.1.2 |
ImageMagick is a suite of image manipulation utilities and libraries used for a wide variety of image formats. imlib is a general image loading and rendering library.
Due to improper bounds checking, ImageMagick and imlib are vulnerable to a buffer overflow when decoding runlength-encoded bitmaps. This bug can be exploited using a specially-crafted BMP image and could potentially allow remote code execution when this image is decoded by the user.
A specially-crafted runlength-encoded BMP could lead ImageMagick and imlib to crash or potentially execute arbitrary code.
There is no known workaround at this time.
All ImageMagick users should upgrade to the latest version:
# emerge sync # emerge -pv ">=media-gfx/imagemagick-6.0.7.1" # emerge ">=media-gfx/imagemagick-6.0.7.1"
All imlib users should upgrade to the latest version:
# emerge sync # emerge -pv ">=media-libs/imlib-1.9.14-r2" # emerge ">=media-libs/imlib-1.9.14-r2"
All imlib2 users should upgrade to the latest version:
# emerge sync # emerge -pv ">=media-libs/imlib2-1.1.2" # emerge ">=media-libs/imlib2-1.1.2"