REDHAT-BUG-511994: Integer Overflow

Tielei Wang has discovered [1] some vulnerabilities in XEmacs, which can be exploited by malicious people to potentially compromise a user's system.

1) An integer overflow error within the "tiffinstantiate()" function in glyphs-eimage.c can be exploited to cause a heap-based buffer overflow via a specially crafted TIFF file.

2) An integer overflow error within the "pnginstantiate()" function in glyphs-eimage.c can be exploited to cause a heap-based buffer overflow via a specially crafted PNG file.

3) An integer overflow error within the "jpeginstantiate()" function in glyphs-eimage.c can be exploited to cause a heap-based buffer overflow via a specially crafted JPEG file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Gentoo [2] reported this upstream [3], and while upstream's bug is not public, the notes in the Gentoo BZ indicate upstream does not really consider this a security bug. Gentoo's BZ also indicates this issue does not exist in emacs.

[1] http://secunia.com/advisories/35348/ [2] http://bugs.gentoo.org/showbug.cgi?id=275397 [3] http://tracker.xemacs.org/XEmacs/its/issue534

Patches taken from Gentoo will be attached to this bug (found in their portage tree; taken from upstream).