Skip to content
OpenAdvisories
Unscored USN-3075-1 8 CVEs

imlib2 vulnerabilities

Published Sep 9, 2016 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Jakub Wilk discovered an out of bounds read in the GIF loader
implementation in Imlib2. An attacker could use this to cause a
denial of service (application crash) or possibly obtain sensitive
information. (CVE-2016-3994)

Yuriy M. Kaminskiy discovered an off-by-one error when handling
coordinates in Imlib2. An attacker could use this to cause a denial of
service (application crash). (CVE-2016-3993)

Yuriy M. Kaminskiy discovered that integer overflows existed in Imlib2
when handling images with large dimensions. An attacker could use
this to cause a denial of service (memory exhaustion or application
crash). (CVE-2014-9771, CVE-2016-4024)

Kevin Ryde discovered that the ellipse drawing code in Imlib2 would
attempt to divide by zero when drawing a 2x1 ellipse. An attacker
could use this to cause a denial of service (application crash).
(CVE-2011-5326)

It was discovered that Imlib2 did not properly handled GIF images
without colormaps. An attacker could use this to cause a denial of
service (application crash). This issue only affected Ubuntu 12.04 LTS
and Ubuntu 14.04 LTS. (CVE-2014-9762)

It was discovered that Imlib2 did not properly handle some PNM images,
leading to a division by zero. An attacker could use this to cause
a denial of service (application crash). This issue only affected
Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)

It was discovered that Imlib2 did not properly handle error conditions
when loading some GIF images. An attacker could use this to cause
a denial of service (application crash). This issue only affected
Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS imlib2 1.4.6-2ubuntu0.1
Ubuntu · 16.04 LTS 16.04:LTS imlib2 1.4.7-1ubuntu0.1

Vulnerabilities 8

  • Unscored —
    CVE-2011-5326

    imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) b…

    imlib2 imlib2 Debian Ubuntu
  • Unscored —
    CVE-2014-9762

    imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a…

    imlib2 imlib2 Debian Ubuntu
  • Unscored —
    CVE-2014-9763

    imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) v…

    imlib2 imlib2 Debian Ubuntu
  • Unscored —
    CVE-2014-9764

    imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.

    imlib2 imlib2 Debian Ubuntu
  • Unscored —
    CVE-2014-9771

    Integer overflow in imlib2 before 1.4.7 allows remote attackers to cause a denial of service (memory consumption or app…

    imlib2 imlib2 Debian Ubuntu
  • Unscored —
    CVE-2016-3993

    Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to…

    imlib2 imlib2 Debian Ubuntu
  • Unscored —
    CVE-2016-3994

    The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtai…

    imlib2 imlib2 Debian Ubuntu
  • Unscored —
    CVE-2016-4024

    Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large…

    imlib2 imlib2 Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2011-5326
  • report
    https://ubuntu.com/security/CVE-2014-9762
  • report
    https://ubuntu.com/security/CVE-2014-9763
  • report
    https://ubuntu.com/security/CVE-2014-9764
  • report
    https://ubuntu.com/security/CVE-2014-9771
  • report
    https://ubuntu.com/security/CVE-2016-3993
  • report
    https://ubuntu.com/security/CVE-2016-3994
  • report
    https://ubuntu.com/security/CVE-2016-4024