zgv image headers heap overflow
| zgv-image-header-bo (17871) |  High Risk |
Description:
zgv is vulnerable to a heap overflow, caused by improper handling of image headers in the following files: readbmp.c, readgif.c, readmrf.c, readpcx.c, readpng.c, readpnm.c, readprf.c, readtiff.c, readxpm.c, and readpcd.c. A remote attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system or possibly cause the system to crash.
Consequences:
Gain Access
Remedy:
Upgrade to the latest version of zgv (5.8 or later), available from the zgv Web page. See References.
For Gentoo Linux:
Upgrade to the latest version of zgv (5.8 or later), as listed in GLSA 200411-12. See References.
For Debian Linux (alias woody):
Upgrade to the latest version of zgv (5.5-3woody2 or later), as listed in DSA-608-1. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Mon Oct 25 2004 - 20:07:17 CDT : zgv image viewing heap overflows.
- BugTraq Mailing List, Oct 27 2004 - 22:39:07 CDT: Re: zgv image viewing heap overflows.
- zgv Web page: zgv - svgalib picture viewer with thumbnail-based file selector.
- BID-11556: ZGV And XZGV Image Viewer Multiple Remote Integer Overflow Vulnerabilities
- CVE-2004-1095: Multiple integer overflows in (1) readbmp.c, (2) readgif.c, (3) readgif.c, (4) readmrf.c, (5) readpcx.c, (6) readpng.c,(7) readpnm.c, (8) readprf.c, (9) readtiff.c, (10) readxbm.c, (11) readxpm.c in zgv 5.8 allow remote attackers to execute arbitrary code via certain image headers that cause calculations to be overflowed and small buffers to be allocated, leading to buffer overflows. NOTE: CVE-2004-0994 and CVE-2004-1095 identify sets of bugs that only partially overlap, despite having the same developer. Therefore, they should be regarded as distinct.
- DSA-608: zgv -- integer overflows
- GLSA-200411-12: zgv: Multiple buffer overflows
Platforms Affected:
- Debian Debian Linux 3.0
- FreeBSD FreeBSD
- Gentoo Linux
- SVGAlib zgv 5.5
Reported:
Oct 25, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net