Re: CVE request: XEmacs Multiple Integer Overflows

["Steven M. Christey" <coley () linus mitre org>]

======================================================
Name: CVE-2009-2688
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2688
Reference: MISC:http://tracker.xemacs.org/XEmacs/its/issue534
Reference: CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=275397
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=511994
Reference: BID:35473
Reference: URL:http://www.securityfocus.com/bid/35473
Reference: OSVDB:55298
Reference: URL:http://osvdb.org/55298
Reference: SECUNIA:35348
Reference: URL:http://secunia.com/advisories/35348
Reference: VUPEN:ADV-2009-1666
Reference: URL:http://www.vupen.com/english/advisories/2009/1666
Reference: XF:xemacs-jpeg-bo(51334)
Reference: URL:http://xforce.iss.net/xforce/xfdb/51334
Reference: XF:xemacs-png-bo(51333)
Reference: URL:http://xforce.iss.net/xforce/xfdb/51333
Reference: XF:xemacs-tiff-bo(51332)
Reference: URL:http://xforce.iss.net/xforce/xfdb/51332

Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4.22, when
running on Windows, allow remote attackers to cause a denial of
service (crash) or execute arbitrary code via (1) the tiff_instantiate
function processing a crafted TIFF file, (2) the png_instantiate
function processing a crafted PNG file, and (3) the jpeg_instantiate
function processing a crafted JPEG file, all which trigger a
heap-based buffer overflow.  NOTE: the provenance of this information
is unknown; the details are obtained solely from third party
information.