[oCERT-2009-009] CamlImages integer overflows Jul 02 2009 01:01PM
Andrea Barisani (lcars ocert org)

#2009-009 CamlImages integer overflows


CamlImages, an open source image processing library, suffers from several
integer overflows which may lead to a potentially exploitable heap overflow and
result in arbitrary code execution.

The vulnerability is triggered by PNG image parsing, the read_png_file and
read_png_file_as_rgb24 functions do not properly validate the width and height
of the image. Specific PNG images with large width and height can be crafted
to trigger the vulnerability.

Affected version:

CamlImages <= 2.2

Fixed version:

Unfortunately oCERT has been unable to get feedback from CamlImages maintainers
and the package seems unmaintained, it's therefore suggested to avoid
CamlImages usage on production or any environment where strong security is

Credit: vulnerability report and PoC code received from Tielei Wang
<wangtielei [at] icst [dot] pku [dot] edu [dot] cn>, ICST-ERCIS.

CVE: CVE-2009-2295


2009-05-21: vulnerability reported received
2009-05-21: contacted camlimages maintainers
2009-06-30: due to lack of feedback oCERT asks reporter to disclose the issue
2009-07-01: reporter agrees to disclosure
2009-07-02: assigned CVE
2009-07-02: advisory release


Andrea Barisani | Founder & Project Coordinator
oCERT | Open Source Computer Emergency Response Team

<lcars (at) ocert (dot) org [email concealed]> http://www.ocert.org
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus