CVE-2009-2660

NameCVE-2009-2660
DescriptionMultiple integer overflows in CamlImages 2.2 might allow context-dependent attackers to execute arbitrary code via images containing large width and height values that trigger a heap-based buffer overflow, related to (1) crafted GIF files (gifread.c) and (2) crafted JPEG files (jpegread.c), a different vulnerability than CVE-2009-2295.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1857-1, DSA-1912-1, DSA-1912-2
NVD severitymedium (attack range: remote)
Debian Bugs540146, 551282

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
advi (PTS)wheezy1.10.2-1+deb7u1fixed
jessie1.10.2-2fixed
buster, sid, stretch1.10.2-3fixed
camlimages (PTS)wheezy1:4.0.1-4fixed
jessie1:4.0.1-8fixed
buster, sid, stretch1:4.2.0-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
advisource(unstable)1.6.0-15low551282
advisourceetch1.6.0-12+etch2mediumDSA-1912-2
advisourcelenny1.6.0-13+lenny2mediumDSA-1912-2
camlimagessource(unstable)1:3.0.1-3low540146
camlimagessourceetch2.20-8+etch3mediumDSA-1912-1
camlimagessourcelenny1:2.2.0-4+lenny3mediumDSA-1912-1

Search for package or bug name: Reporting problems