Description
Multiple vulnerabilities in xli before 1.17 may allow remote attackers to execute arbitrary code via "buffer management errors" from certain image properties, some of which may be related to integer overflows in PPM files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-695-1 xli - buffer overflow, input sanitising, integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-694-1 xloadimage - missing input sanitising, integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200503-05 vendor-advisory
- 14459 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=79762
- DSA-695 vendor-advisory