{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:17:30.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227"
          },
          {
            "name": "[Enlightenment-announce] 20160501 imlib2 1.4.9",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://sourceforge.net/p/enlightenment/mailman/message/35055012/"
          },
          {
            "name": "GLSA-201611-12",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201611-12"
          },
          {
            "name": "DSA-3555",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3555"
          },
          {
            "name": "1035573",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035573"
          },
          {
            "name": "86073",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/86073"
          },
          {
            "name": "openSUSE-SU-2016:1330",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-04-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-02T09:57:01.000Z",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227"
        },
        {
          "name": "[Enlightenment-announce] 20160501 imlib2 1.4.9",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://sourceforge.net/p/enlightenment/mailman/message/35055012/"
        },
        {
          "name": "GLSA-201611-12",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201611-12"
        },
        {
          "name": "DSA-3555",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3555"
        },
        {
          "name": "1035573",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1035573"
        },
        {
          "name": "86073",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/86073"
        },
        {
          "name": "openSUSE-SU-2016:1330",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2016-4024",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227",
              "refsource": "CONFIRM",
              "url": "https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227"
            },
            {
              "name": "[Enlightenment-announce] 20160501 imlib2 1.4.9",
              "refsource": "MLIST",
              "url": "https://sourceforge.net/p/enlightenment/mailman/message/35055012/"
            },
            {
              "name": "GLSA-201611-12",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201611-12"
            },
            {
              "name": "DSA-3555",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3555"
            },
            {
              "name": "1035573",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1035573"
            },
            {
              "name": "86073",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/86073"
            },
            {
              "name": "openSUSE-SU-2016:1330",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2016-4024",
    "datePublished": "2016-05-13T16:00:00.000Z",
    "dateReserved": "2016-04-14T00:00:00.000Z",
    "dateUpdated": "2024-08-06T00:17:30.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2011-5326",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-9762",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-9763",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-9764",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-9771",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3993",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3994",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-4024",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libimlib2",
            "binary_version": "1.4.6-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "imlib2",
        "purl": "pkg:deb/ubuntu/imlib2@1.4.6-2ubuntu0.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.6-2ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.5-1ubuntu2",
        "1.4.6-1",
        "1.4.6-2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2011-5326",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3993",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3994",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-4024",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libimlib2",
            "binary_version": "1.4.7-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "imlib2",
        "purl": "pkg:deb/ubuntu/imlib2@1.4.7-1ubuntu0.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.7-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.7-1",
        "1.4.7-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "Jakub Wilk discovered an out of bounds read in the GIF loader\nimplementation in Imlib2. An attacker could use this to cause a\ndenial of service (application crash) or possibly obtain sensitive\ninformation. (CVE-2016-3994)\n\nYuriy M. Kaminskiy discovered an off-by-one error when handling\ncoordinates in Imlib2. An attacker could use this to cause a denial of\nservice (application crash). (CVE-2016-3993)\n\nYuriy M. Kaminskiy discovered that integer overflows existed in Imlib2\nwhen handling images with large dimensions. An attacker could use\nthis to cause a denial of service (memory exhaustion or application\ncrash). (CVE-2014-9771, CVE-2016-4024)\n\nKevin Ryde discovered that the ellipse drawing code in Imlib2 would\nattempt to divide by zero when drawing a 2x1 ellipse. An attacker\ncould use this to cause a denial of service (application crash).\n(CVE-2011-5326)\n\nIt was discovered that Imlib2 did not properly handled GIF images\nwithout colormaps. An attacker could use this to cause a denial of\nservice (application crash). This issue only affected Ubuntu 12.04 LTS\nand Ubuntu 14.04 LTS. (CVE-2014-9762)\n\nIt was discovered that Imlib2 did not properly handle some PNM images,\nleading to a division by zero. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)\n\nIt was discovered that Imlib2 did not properly handle error conditions\nwhen loading some GIF images. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)\n",
  "id": "USN-3075-1",
  "modified": "2026-04-22T07:36:33Z",
  "published": "2016-09-09T03:48:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3075-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2011-5326"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9762"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9763"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9764"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9771"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-3993"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-3994"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-4024"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "imlib2 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2011-5326",
    "UBUNTU-CVE-2014-9762",
    "UBUNTU-CVE-2014-9763",
    "UBUNTU-CVE-2014-9764",
    "UBUNTU-CVE-2014-9771",
    "UBUNTU-CVE-2016-3993",
    "UBUNTU-CVE-2016-3994",
    "UBUNTU-CVE-2016-4024"
  ]
}