CVE-2016-3994
HighSummary
The GIF loader in imlib2 before version 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers an out-of-bounds read.
Risk Assessment
The organization may experience application downtime and potential loss of sensitive data.
Recommendation
It is recommended to update imlib2 to version 1.4.9 or later to mitigate this vulnerability.
Other vulnerabilities in imlib2
See all- CVE-2016-3993High
Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before version 1.4.9 allows remote attackers to cause a denial of service via crafted coordinates.
- CVE-2014-9771High
Integer overflow in imlib2 before version 1.4.7 allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted image, leading to an invalid read operation.
- CVE-2014-9764High
Imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.
- CVE-2014-9763High
Imlib2 before 1.4.7 allows remote attackers to cause a denial of service via a crafted PNM file, leading to a divide-by-zero error and application crash.
- CVE-2014-9762High
Imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.
- CVE-2011-5326High
Imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.
- CVE-2016-4024Critical
Integer overflow in imlib2 before version 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, leading to an out-of-bounds heap memory write operation.
Original NVD description (English source)
The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers an out-of-bounds read.