CVE-2009-2175 Stack-based buffer overflow in the flattenIncrementally function in flatten.c in xcftools 1.0.4, as reachable from the (1) xcf2pnm and (2) xcf2png utilities, allows remote attackers to cause a denial....
MediumCVSS 4.3
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the flattenIncrementally function in flatten.c in xcftools 1.0.4, as reachable from the (1) xcf2pnm and (2) xcf2png utilities, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted image that causes a conversion to a location "above or to the left of the canvas." NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| henning makholm xcftools | = 1.0.4 | No fix listed |
| debian/xcftools(Debian:10) | < 1.0.7-1 | 1.0.7-1 |
References
- bugs.debian.org patch
- FEDORA-2010-17041 vendor-advisory
- FEDORA-2010-17035 vendor-advisory
- FEDORA-2010-17004 vendor-advisory
- 55187 vdb-entry
- 35397 third-party-advisory vendor-advisory
- 43883 vdb-entry
- ADV-2009-1638 vdb-entry vendor-advisory