Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4.22, when running on Windows, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) the tiffinstantiate function processing a crafted TIFF file, (2) the pnginstantiate function processing a crafted PNG file, and (3) the jpeginstantiate function processing a crafted JPEG file, all which trigger a heap-based buffer overflow. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Tielei Wang has discovered [1] some vulnerabilities in XEmacs, which can be exploited by malicious people to potentially compromise a user's system.

1) An integer overflow error within the "tiffinstantiate()" function in glyphs-eimage.c can be exploited to cause a heap-based buffer overflow via a specially crafted TIFF file.

2) An integer overflow error within the "pnginstantiate()" function in glyphs-eimage.c can be exploited to cause a heap-based buffer overflow via a specially crafted PNG file.

3) An integer overflow error within the "jpeginstantiate()" function in glyphs-eimage.c can be exploited to cause a heap-based buffer overflow via a specially crafted JPEG file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Gentoo [2] reported this upstream [3], and while upstream's bug is not public, the notes in the Gentoo BZ indicate upstream does not really consider this a security bug. Gentoo's BZ also indicates this issue does not exist in emacs.

[1] http://secunia.com/advisories/35348/ [2] http://bugs.gentoo.org/showbug.cgi?id=275397 [3] http://tracker.xemacs.org/XEmacs/its/issue534

Patches taken from Gentoo will be attached to this bug (found in their portage tree; taken from upstream).

rcs2log, as used in Emacs 20.4, xemacs 21.1.10 and other versions before 21.4, and possibly other packages, allows local users to modify files of other users via a symlink attack on a temporary file.