debian/devil vulnerabilities

Latest debian/devil CVEs

Newest publication first

1. CVE-2017-20286 DevIL: DevIL: Arbitrary code execution via crafted GIF image

   Published 2026-10-14

   High·CVSS 8.5

   DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local co...

2. CVE-2009-3994 Stack-based buffer overflow in the GetUID function in src-IL/src/il_dicom.c in DevIL 1.7.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a craf...

   Published 2009-12-08

   High·CVSS 9.3

   Stack-based buffer overflow in the GetUID function in src-IL/src/il_dicom.c in DevIL 1.7.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted DICOM file.

3. DSA-1717-1 devil - buffer overflow

   Published 2009-02-05

   Unknown

4. DTSA-184-1 devil - arbitrary code execution

   Published 2009-01-17

   Unknown

5. CVE-2008-5262 Multiple stack-based buffer overflows in the iGetHdrHeader function in src-IL/src/il_hdr.c in DevIL 1.7.4 allow context-dependent attackers to execute arbitrary code via a crafted Radiance RGBE file.

   Published 2009-01-13

   High·CVSS 7.5

   Multiple stack-based buffer overflows in the iGetHdrHeader function in src-IL/src/il_hdr.c in DevIL 1.7.4 allow context-dependent attackers to execute arbitrary code via a crafted Radiance RGBE file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.