#2009-009 CamlImages integer overflows Description: CamlImages, an open source image processing library, suffers from several integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. The vulnerability is triggered by PNG image parsing, the read_png_file and read_png_file_as_rgb24 functions do not properly validate the width and height of the image. Specific PNG images with large width and height can be crafted to trigger the vulnerability. Affected version: CamlImages <= 2.2 Fixed version: Unfortunately oCERT has been unable to get feedback from CamlImages maintainers and the package seems unmaintained, it's therefore suggested to avoid CamlImages usage on production or any environment where strong security is needed. Credit: vulnerability report and PoC code received from Tielei Wang <wangtielei [at] icst [dot] pku [dot] edu [dot] cn>, ICST-ERCIS. CVE: CVE-2009-2295 Timeline: 2009-05-21: vulnerability reported received 2009-05-21: contacted camlimages maintainers 2009-06-30: due to lack of feedback oCERT asks reporter to disclose the issue 2009-07-01: reporter agrees to disclosure 2009-07-02: assigned CVE 2009-07-02: advisory release Permalink: http://www.ocert.org/advisories/ocert-2009-009.html -- Andrea Barisani | Founder & Project Coordinator oCERT | Open Source Computer Emergency Response Team <lcars (at) ocert (dot) org [email concealed]> http://www.ocert.org 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate"