DevIL: User-assisted execution of arbitrary code

DevIL: User-assisted execution of arbitrary code Multiple boundary errors in DevIL may allow for the execution of arbitrary code. devil 2009-03-06 2009-03-06 255217 remote 1.7.7 1.7.7

Developer's Image Library (DevIL) is a cross-platform image library.

Stefan Cornelius (Secunia Research) discovered two boundary errors within the iGetHdrHeader() function in src-IL/src/il_hdr.c.

A remote attacker could entice a user to open a specially crafted Radiance RGBE file, possibly resulting in the execution of arbitrary code.

There is no known workaround at this time.

All DevIL users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=media-libs/devil-1.7.7"

CVE-2008-5262 keytoaster keytoaster p-y