Full Disclosure mailing list archives
Re: [gif2png] long filename Buffer Overrun
From: Razuel Akaharnath <razuel () gmail com>
Date: Sun, 13 Dec 2009 16:10:10 +0200
I see, well according to the bug report, its fixed in 2.5.2-1. I tested that version itself and sadly the fix isn't there. On Sun, Dec 13, 2009 at 1:29 AM, Patroklos Argyroudis <argp () census-labs com>wrote:
On Sat, Dec 12, 2009 at 10:59:28PM +0200, Razuel Akaharnath wrote:DESCRIPTION: "The gif2png program converts files from the obsolescent GraphicInterchangeFormat to Portable Network Graphics <http://www.libpng.org/pub/png/>.Theconversion preserves all graphic information, including transparency, perfectly. The gif2png program can even recover data from corruptedGIFs."homepage: http://catb.org/~esr/gif2png/<http://catb.org/%7Eesr/gif2png/><http://catb.org/%7Eesr/gif2png/>VULNERABILITY: gif2png does not perform proper bounds checking on the size of input filename. The buffer (1025 in size) is easily overrun with a strcpy function. AFFECTED VERSION: latest: 2.5.2I have reported this to Debian about two months ago: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550978 -- Patroklos Argyroudis http://www.census-labs.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [gif2png] long filename Buffer Overrun Razuel Akaharnath (Dec 12)
- Re: [gif2png] long filename Buffer Overrun Patroklos Argyroudis (Dec 13)
- Re: [gif2png] long filename Buffer Overrun Razuel Akaharnath (Dec 13)
- Re: [gif2png] long filename Buffer Overrun Nico Golde (Dec 13)
- Re: [gif2png] long filename Buffer Overrun Raphael Geissert (Dec 14)
- Re: [gif2png] long filename Buffer Overrun Razuel Akaharnath (Dec 13)
- <Possible follow-ups>
- Re: [gif2png] long filename Buffer Overrun Razuel Akaharnath (Dec 13)
- Re: [gif2png] long filename Buffer Overrun Jubei Trippataka (Dec 14)
- Message not available
- Re: [gif2png] long filename Buffer Overrun Razuel Akaharnath (Dec 15)
- Re: [gif2png] long filename Buffer Overrun Jubei Trippataka (Dec 14)
- Re: [gif2png] long filename Buffer Overrun Patroklos Argyroudis (Dec 13)