FKIE_CVE-2008-5187

Vulnerability from fkie_nvd - Published: 2008-11-21 02:30 - Updated: 2026-06-16 22:59
Severity
Summary
The load function in the XPM loader for imlib2 1.4.2, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XPM file that triggers a "pointer arithmetic error" and a heap-based buffer overflow, a different vulnerability than CVE-2008-2426.
References
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
cve@mitre.orghttp://osvdb.org/49970
cve@mitre.orghttp://secunia.com/advisories/32796Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/32843
cve@mitre.orghttp://secunia.com/advisories/32949
cve@mitre.orghttp://secunia.com/advisories/32963
cve@mitre.orghttp://secunia.com/advisories/33323
cve@mitre.orghttp://secunia.com/advisories/33568
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200812-23.xml
cve@mitre.orghttp://www.debian.org/security/2008/dsa-1672
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2009:019
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2008/11/20/5
cve@mitre.orghttp://www.securityfocus.com/bid/32371
cve@mitre.orghttp://www.ubuntu.com/usn/USN-683-1
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/3212
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00856.html
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00858.html
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/49970
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32796Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32843
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32949
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32963
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33323
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33568
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200812-23.xml
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2008/dsa-1672
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2009:019
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2008/11/20/5
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/32371
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-683-1
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/3212
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00856.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00858.html
Impacted products
Vendor Product Version
enlightenment imlib2 1.4.2
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:enlightenment:imlib2:1.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABE10952-EB03-4E87-8E8A-51E2A786989A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The load function in the XPM loader for imlib2 1.4.2, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XPM file that triggers a \"pointer arithmetic error\" and a heap-based buffer overflow, a different vulnerability than CVE-2008-2426."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n de carga en el cargador XPM para imlib2 v1.4.2, y posiblemente otras versiones, que permite a atacantes producir una denegaci\u00f3n de servicio (ca\u00edda) y posiblemente una ejecuci\u00f3n de c\u00f3digo a elecci\u00f3n del atacante a trav\u00e9s de un fichero XPM que dispara un \"error aritm\u00e9tico de puntero\" desbordamiento de b\u00fafer basado en mont\u00edculo, se trata de una vulnerabilidad diferente de CVE-2008-2426. NOTA: La procedencia de la informaci\u00f3n es desconocida; Los detalles han sido obtenidos \u00fanicamente de una tercera parte."
    }
  ],
  "id": "CVE-2008-5187",
  "lastModified": "2026-06-16T22:59:25.560",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-11-21T02:30:00.547",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/49970"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/32796"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32843"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32949"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32963"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/33323"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/33568"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200812-23.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2008/dsa-1672"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:019"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2008/11/20/5"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/32371"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-683-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/3212"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00856.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00858.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/49970"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/32796"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32843"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32949"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32963"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33323"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33568"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200812-23.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2008/dsa-1672"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:019"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2008/11/20/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/32371"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-683-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/3212"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00856.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00858.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vendorComments": [
    {
      "comment": "Not vulnerable. This issue does not affect the versions of imlib as shipped with Red Hat Enterprise Linux 2.1, 3, or 4.",
      "lastModified": "2008-11-21T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.