Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 5 Aug 2009 14:59:33 -0400 (EDT)
From: "Steven M. Christey" <>
Subject: Re: CVE request: XEmacs Multiple Integer Overflows

Name: CVE-2009-2688
Status: Candidate
Reference: MISC:
Reference: CONFIRM:
Reference: CONFIRM:
Reference: BID:35473
Reference: URL:
Reference: OSVDB:55298
Reference: URL:
Reference: SECUNIA:35348
Reference: URL:
Reference: VUPEN:ADV-2009-1666
Reference: URL:
Reference: XF:xemacs-jpeg-bo(51334)
Reference: URL:
Reference: XF:xemacs-png-bo(51333)
Reference: URL:
Reference: XF:xemacs-tiff-bo(51332)
Reference: URL:

Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4.22, when
running on Windows, allow remote attackers to cause a denial of
service (crash) or execute arbitrary code via (1) the tiff_instantiate
function processing a crafted TIFF file, (2) the png_instantiate
function processing a crafted PNG file, and (3) the jpeg_instantiate
function processing a crafted JPEG file, all which trigger a
heap-based buffer overflow.  NOTE: the provenance of this information
is unknown; the details are obtained solely from third party

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.