CVE-2012-4433: Buffer Overflow
An integer overflow, leading to heap-based buffer overflow was found in the way portable pixmap format (PPM) image file format handler of GEGL, a graph based image processing framework, processed certain input PPM image file headers. A remote attacker could provide a specially-crafted PPM image that when opened in gegl executable would lead to crash, or, potentially arbitrary code execution with the privileges of the user running the binary.
This issue was found by Murray McAllister, Red Hat Security Response Team.
Other sources
Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large (1) width or (2) height value in a Portable Pixel Map (ppm) image, which triggers a heap-based buffer overflow.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4433?
CVE-2012-4433 has been rated as potentially critical due to the possibility of remote code execution via heap-based buffer overflow.
How do I fix CVE-2012-4433?
To mitigate CVE-2012-4433, update GEGL to the latest version that addresses the vulnerability.
What type of vulnerability is CVE-2012-4433?
CVE-2012-4433 is classified as an integer overflow leading to a heap-based buffer overflow.
Which versions of GEGL are affected by CVE-2012-4433?
CVE-2012-4433 specifically affects GEGL version 0.2.0.
Can an attacker exploit CVE-2012-4433 remotely?
Yes, an attacker can exploit CVE-2012-4433 remotely by sending a specially crafted PPM image file.