Debian Bug report logs - #271375
libimlib2: BMP remote heap overflow in imlib2

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@informatik.uni-bremen.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libimlib2: BMP remote heap overflow in imlib2

Date: Sun, 12 Sep 2004 22:43:27 +0200

Package: libimlib2
Version: 1.1.0-12.3
Severity: grave
Tags: security
Justification: user security hole

The infamous BMP remote heap overflow, which is already fixed for
imlib+png is also present in imlib2:

The recently released upstream version 1.1.2 fixes the problem:

> Tue Aug 31 11:46:49 JST 2004
> (Raster)
> 
> Fixed bmp security issue.
> New IFF ILBM loader
> Up to 1.1.2

Cheers,
        Moritz

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.7
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15@euro

Versions of packages libimlib2 depends on:
ii  libc6                     2.3.2.ds1-16   GNU C Library: Shared libraries an
ii  libfreetype6              2.1.7-2.2      FreeType 2 font engine, shared lib
ii  libjpeg62                 6b-9           The Independent JPEG Group's JPEG 
ii  libpng12-0                1.2.5.0-7      PNG library - runtime
ii  libtiff4                  3.6.1-1.1      Tag Image File Format library
ii  libungif4g                4.1.3-1        shared library for GIF images (run
ii  libx11-6                  4.3.0.dfsg.1-7 X Window System protocol client li
ii  libxext6                  4.3.0.dfsg.1-7 X Window System miscellaneous exte
ii  xlibs                     4.3.0.dfsg.1-7 X Window System client libraries m
ii  zlib1g                    1:1.2.1.1-7    compression library - runtime

-- no debconf information

Message #10 received at 271375@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <martin.pitt@canonical.com>

To: 271375@bugs.debian.org

Subject: Backported patch

Date: Mon, 13 Sep 2004 10:52:28 +0200

[Message part 1 (text/plain, inline)]

tag 271375 patch
thanks

I backported the patch from upstream's 1.1.2 release, you can get it
from

  http://we.give.back.to.debian.no-name-yet.com/patches/imlib2.271375.diff

Thanks,

Martin

-- 
Martin Pitt                 Debian GNU/Linux Developer
martin@piware.de                      mpitt@debian.org
http://www.piware.de             http://www.debian.org

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 271375-done@bugs.debian.org (full text, mbox, reply):

From: "Laurence J. Lane" <ljlane@debian.org>

To: 271375-done@bugs.debian.org

Subject: closed

Date: Sun, 28 Nov 2004 13:52:13 -0600

closed

Send a report that this bug log contains spam.