USN-3075-1: Imlib2 vulnerabilities

9 September 2016

imlib2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Imlib2.

Software Description

  • imlib2 - Image manipulation and rendering library

Details

Jakub Wilk discovered an out of bounds read in the GIF loader implementation in Imlib2. An attacker could use this to cause a denial of service (application crash) or possibly obtain sensitive information. (CVE-2016-3994)

Yuriy M. Kaminskiy discovered an off-by-one error when handling coordinates in Imlib2. An attacker could use this to cause a denial of service (application crash). (CVE-2016-3993)

Yuriy M. Kaminskiy discovered that integer overflows existed in Imlib2 when handling images with large dimensions. An attacker could use this to cause a denial of service (memory exhaustion or application crash). (CVE-2014-9771, CVE-2016-4024)

Kevin Ryde discovered that the ellipse drawing code in Imlib2 would attempt to divide by zero when drawing a 2x1 ellipse. An attacker could use this to cause a denial of service (application crash). (CVE-2011-5326)

It was discovered that Imlib2 did not properly handled GIF images without colormaps. An attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9762)

It was discovered that Imlib2 did not properly handle some PNM images, leading to a division by zero. An attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)

It was discovered that Imlib2 did not properly handle error conditions when loading some GIF images. An attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04 LTS
libimlib2 - 1.4.7-1ubuntu0.1
Ubuntu 14.04 LTS
libimlib2 - 1.4.6-2ubuntu0.1
Ubuntu 12.04 LTS
libimlib2 - 1.4.4-1ubuntu0.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you will need to restart applications that make use of Imlib2 to make all the necessary changes.

References