DevIL: User-assisted execution of arbitrary code

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
media-libs/devil	< 1.7.7	>= 1.7.7	All supported architectures

Related bugreports: #255217

Multiple boundary errors in DevIL may allow for the execution of arbitrary code.

2. Impact Information

Developer's Image Library (DevIL) is a cross-platform image library.

Stefan Cornelius (Secunia Research) discovered two boundary errors within the iGetHdrHeader() function in src-IL/src/il_hdr.c.

A remote attacker could entice a user to open a specially crafted Radiance RGBE file, possibly resulting in the execution of arbitrary code.

3. Resolution Information

There is no known workaround at this time.

All DevIL users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/devil-1.7.7"

4. References

Page updated March 06, 2009

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.