Secunia discovered imlib2 vulnerability that can be used to execute arbitrary code within the application that uses this library: ----- The vulnerability is caused due to a pointer arithmetic error within the "load()" function provided by the XPM loader. This can be exploited to cause a heap-based buffer overflow via a specially crafted XPM file. Successful exploitation may allow execution of arbitrary code. ----- Fix: The following patch adds the patch from Debian developers. It is supposed to fix the issue. The following VuXML entry should be validated and added: <vuln vid=""> <topic>imlib2 -- XPM processing buffer overflow vulnerability</topic> <affects> <package> <name>imlib2</name> <name>imlib2-nox11</name> <range><lt>1.4.1.000_1,2</lt></range> </package> </affects> <description> <body xmlns="http://www.w3.org/1999/xhtml"> <p>Secunia reports:</p> <blockquote cite="http://secunia.com/Advisories/32796"> <p>A vulnerability has been discovered in imlib2, which can be exploited by malicious people to potentially compromise an application using the library.</p> <p>The vulnerability is caused due to a pointer arithmetic error within the "load()" function provided by the XPM loader. This can be exploited to cause a heap-based buffer overflow via a specially crafted XPM file.</p> <p>Successful exploitation may allow execution of arbitrary code.</p> <p>The vulnerability is confirmed in version 1.4.2. Other versions may also be affected.</p> </blockquote> </body> </description> <references> <cvename>CVE-2008-5187</cvename> <url>http://secunia.com/Advisories/32796</url> <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15</url> <url>http://bugzilla.enlightenment.org/show_bug.cgi?id=547</url> </references> <dates> <discovery>2008-11-20</discovery> </dates> </vuln> --- vuln.xml ends here --- I see that XPM loader is built and installed even for the nox11 version, so I am including it to the vulnerable port. imlib-1.9.15 seem to be unaffected: it has the code in question, but it does memory manipulations properly.--7AR1l9Ydg8ndHIUGPsPulQ9JfDajIegRcghEzsn7acyVl0OB Content-Type: text/plain; name="fix-imlib2-1.4.1.000.diff" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="fix-imlib2-1.4.1.000.diff" diff -urN ./Makefile ../imlib2/Makefile --- ./Makefile 2008-11-20 20:30:31.000000000 +0300 +++ ../imlib2/Makefile 2008-11-21 08:28:40.000000000 +0300 @@ -7,7 +7,7 @@ PORTNAME= imlib2 PORTVERSION= 1.4.1.000 -PORTREVISION= 0 +PORTREVISION= 1 PORTEPOCH= 2 CATEGORIES= graphics MASTER_SITES= ftp://ftp.springdaemons.com/pub/snapshots/e17/ \ diff -urN ./files/patch-CVE-2008-5187 ../imlib2/files/patch-CVE-2008-5187 --- ./files/patch-CVE-2008-5187 1970-01-01 03:00:00.000000000 +0300 +++ ../imlib2/files/patch-CVE-2008-5187 2008-11-21 08:24:16.000000000 +0300 @@ -0,0 +1,14 @@ +Obtained from: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15 + +--- src/modules/loaders/loader_xpm.c ++++ src/modules/loaders/loader_xpm.c +@@ -246,8 +246,8 @@ + return 0; + } + ptr = im->data; +- end = ptr + (sizeof(DATA32) * w * h); + pixels = w * h; ++ end = ptr + pixels; + } + else + { How-To-Repeat: http://secunia.com/Advisories/32796 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5187
Responsible Changed From-To: freebsd-ports-bugs->stas Over to maintainer (via the GNATS Auto Assign Tool)
stas 2008-11-24 17:47:53 UTC FreeBSD ports repository Modified files: security/vuxml vuln.xml Log: - Document a buffer overflow vulnerability in imlib2. PR: ports/129037 Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru> Revision Changes Path 1.1764 +39 -1 ports/security/vuxml/vuln.xml _______________________________________________ cvs-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/cvs-all To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
stas 2008-11-24 17:50:04 UTC FreeBSD ports repository Modified files: graphics/imlib2 Makefile Added files: graphics/imlib2/files patch-CVE-2008-5187 Log: - Fix a buffer overflow vulnerability in imlib2. PR: ports/129037 Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru> Security: http://www.vuxml.org/freebsd/910486d5-ba4d-11dd-8f23-0019666436c2.html Revision Changes Path 1.129 +1 -1 ports/graphics/imlib2/Makefile 1.1 +14 -0 ports/graphics/imlib2/files/patch-CVE-2008-5187 (new) _______________________________________________ cvs-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/cvs-all To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
State Changed From-To: open->closed Committed, with minor changes. Thanks!