SB2016112003 - Gentoo update for imlib2

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2014-9762)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.

2) Division by zero (CVE-ID: CVE-2014-9763)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to divide-by-zero error within imlib2 before 1.4.7. A remote attacker can perform a denial of service (divide-by-zero error and application crash) via a crafted PNM file.

3) Input validation error (CVE-ID: CVE-2014-9764)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.

4) Buffer overflow (CVE-ID: CVE-2016-4024)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/201611-12