Description
Multiple heap-based buffer overflows in imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | imlib | 1.9.14-2woody2 | DSA-618-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | imlib +1 | 1:1.9.13-13.4 | RHSA-2004:651 |
Advisories 2
- RHSA-2004:651 Red Hat Security Advisory: imlib security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-618-1 imlib - buffer overflows, integer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2005:007 vendor-advisory
- 11830 vdb-entry
- RHSA-2004:651 vendor-advisory
- oval:org.mitre.oval:def:10786 vdb-entry signature