CVE-2016-3993: Buffer Overflow
Published Apr 2, 2016
·Updated
Off-by-one error in the imlibMergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted coordinates.
Affected Software
5 affected componentsFixes available
debian/imlib2<=1.4.6-2+deb8u1, <=1.4.5-1
1.4.8-11.4.6-2+deb8u21.4.5-1+deb7u2
debian/imlib2
1.7.1-2+deb11u11.10.0-4+deb12u11.12.1-1.1
Enlightenment imlib2<=1.4.8
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Event History
May 13, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-3993?
CVE-2016-3993 is considered a moderate risk vulnerability due to potential denial of service from an out-of-bounds read.
2
How do I fix CVE-2016-3993?
To fix CVE-2016-3993, upgrade to Imlib2 version 1.4.9 or later.
3
Which versions of Imlib2 are affected by CVE-2016-3993?
Imlib2 versions prior to 1.4.9, including 1.4.8 and earlier, are affected by CVE-2016-3993.
4
Does CVE-2016-3993 affect Debian systems?
Yes, CVE-2016-3993 affects Debian Linux versions 7.0 and 8.0 with Imlib2 installed.
5
Can CVE-2016-3993 be exploited remotely?
Yes, CVE-2016-3993 can be exploited by remote attackers via crafted coordinates.