Package: sam2p X-Debbugs-CC: t...@security.debian.org secure-testing-team@lists.alioth.debian.org Severity: grave Tags: security
Hi, the following vulnerabilities were published for sam2p. CVE-2017-14637[0]: | In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb | function in in_xpm.cpp. However, this can also cause a write to an | illegal address. CVE-2017-14636[1]: | Because of an integer overflow in sam2p 0.49.3, a loop executes | 0xffffffff times, ending with an invalid read of size 1 in the | Image::Indexed::sortPal function in image.cpp. However, this also | causes memory corruption because of an attempted write to the invalid | d[0xfffffffe] array element. CVE-2017-14628[2]: | In sam2p 0.49.3, a heap-based buffer overflow exists in the | pcxLoadImage24 function of the file in_pcx.cpp. CVE-2017-14629[3]: | In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an | integer signedness error, leading to a crash when writing to an | out-of-bounds array element. CVE-2017-14630[4]: | In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 | function of the file in_pcx.cpp, leading to an invalid write operation. CVE-2017-14631[5]: | In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an | integer signedness error leading to a heap-based buffer overflow. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-14637 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14637 [1] https://security-tracker.debian.org/tracker/CVE-2017-14636 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14636 [2] https://security-tracker.debian.org/tracker/CVE-2017-14628 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14628 [3] https://security-tracker.debian.org/tracker/CVE-2017-14629 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14629 [4] https://security-tracker.debian.org/tracker/CVE-2017-14630 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14630 [5] https://security-tracker.debian.org/tracker/CVE-2017-14631 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14631 Please adjust the affected versions in the BTS as needed. _______________________________________________ Secure-testing-team mailing list Secure-testing-team@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-team
