kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document integer overflows in xli.

Browse source
This commit is contained in:
Jacques Vidrine 2005-06-03 18:24:44 +00:00
parent 332584b9f0
commit 3bf8b576b5
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=136748
1 changed files with 26 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
security/vuxml/vuln.xml
View file

@ -32,6 +32,32 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="bfbbd505-3bd6-409c-8c67-445d3635cf4b">
<topic>xli -- integer overflows in image size calculations</topic>
<affects>
<package>
<name>xli</name>
<range><le>1.17.0_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tavis Ormandy discovered several integer overflows in xli's
image size handling. A maliciously crafted image may be able
to cause a heap buffer overflow and execute arbitrary code.</p>
</body>
</description>
<references>
<cvename>CAN-2005-0639</cvename>
<url>http://bugs.gentoo.org/show_bug.cgi?id=79762</url>
<url>http://pantransit.reptiles.org/prog/xli/CHANGES</url>
</references>
<dates>
<discovery>2005-02-08</discovery>
<entry>2005-06-03</entry>
</dates>
</vuln>
<vuln vid="310d0087-0fde-4929-a41f-96f17c5adffe">
<topic>xloadimage -- arbitrary command execution when handling
compressed files</topic>