Joined: 12 May 2004
|Posted: Sat Mar 07, 2009 1:26 am Post subject: [ GLSA 200903-04 ] DevIL: User-assisted execution of arbitra
|Gentoo Linux Security Advisory
Title: DevIL: User-assisted execution of arbitrary code (GLSA 200903-04)
Date: March 06, 2009
Multiple boundary errors in DevIL may allow for the execution of arbitrary code.
Developer's Image Library (DevIL) is a cross-platform image library.
Vulnerable: < 1.7.7
Unaffected: >= 1.7.7
Architectures: All supported architectures
Stefan Cornelius (Secunia Research) discovered two boundary errors within the iGetHdrHeader() function in src-IL/src/il_hdr.c.
A remote attacker could entice a user to open a specially crafted Radiance RGBE file, possibly resulting in the execution of arbitrary code.
There is no known workaround at this time.
All DevIL users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/devil-1.7.7"