REDHAT-BUG-511994: Integer Overflow

First published: Wed Jul 15 2009(Updated: )

Tielei Wang has discovered [1] some vulnerabilities in XEmacs, which can be exploited by malicious people to potentially compromise a user's system. 1) An integer overflow error within the "tiff_instantiate()" function in glyphs-eimage.c can be exploited to cause a heap-based buffer overflow via a specially crafted TIFF file. 2) An integer overflow error within the "png_instantiate()" function in glyphs-eimage.c can be exploited to cause a heap-based buffer overflow via a specially crafted PNG file. 3) An integer overflow error within the "jpeg_instantiate()" function in glyphs-eimage.c can be exploited to cause a heap-based buffer overflow via a specially crafted JPEG file. Successful exploitation of the vulnerabilities may allow execution of arbitrary code. Gentoo [2] reported this upstream [3], and while upstream's bug is not public, the notes in the Gentoo BZ indicate upstream does not really consider this a security bug. Gentoo's BZ also indicates this issue does not exist in emacs. [1] <a href="http://secunia.com/advisories/35348/">http://secunia.com/advisories/35348/</a> [2] <a href="http://bugs.gentoo.org/show_bug.cgi?id=275397">http://bugs.gentoo.org/show_bug.cgi?id=275397</a> [3] <a href="http://tracker.xemacs.org/XEmacs/its/issue534">http://tracker.xemacs.org/XEmacs/its/issue534</a> Patches taken from Gentoo will be attached to this bug (found in their portage tree; taken from upstream).

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/references
• agent/type
• agent/first-publish-date
• agent/last-modified-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2009-2688
• agent/source
• agent/weakness
• agent/severity
• agent/description
• agent/event
• agent/tags
• agent/softwarecombine
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/xemacs
• canonical/gnu xemacs