Description
Multiple heap-based buffer overflows in imlib2 1.4.3 allow context-dependent attackers to execute arbitrary code via a crafted (1) ARGB, (2) XPM, or (3) BMP file, related to the IMAGE_DIMENSIONS_OK macro in lib/image.h.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | imlib2 | 1.4.9-1.4 | openSUSE-SU-2024:10320-1 |
Advisories 1
- openSUSE-SU-2024:10320-1 imlib2-1.4.9-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 39354 third-party-advisory
- 20100421 Secunia Research: imlib2 "IMAGE_DIMENSIONS_OK()" Logic Error mailing-list
- ADV-2010-0959 vdb-entry
- http://secunia.com/secunia_research/2010-54/