6.8

CVE-2007-5137

Buffer overflow in the ReadImage function in generic/tkImgGIF.c in Tcl (Tcl/Tk) 8.4.13 through 8.4.15 allows remote attackers to execute arbitrary code via multi-frame interlaced GIF files in which later frames are smaller than the first.  NOTE: this issue is due to an incorrect patch for CVE-2007-5378.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tcl Tk ≫ Tcl Tk Version8.4.13
Tcl Tk ≫ Tcl Tk Version8.4.14
Tcl Tk ≫ Tcl Tk Version8.4.15
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.86% 0.909
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://secunia.com/advisories/27229
http://www.novell.com/linux/security/advisories/2007_20_sr.html
http://bugs.gentoo.org/show_bug.cgi?id=192539
http://secunia.com/advisories/26942
Patch
Vendor Advisory
http://secunia.com/advisories/27086
http://secunia.com/advisories/27182
http://secunia.com/advisories/27207
http://secunia.com/advisories/27295
http://secunia.com/advisories/29069
http://secunia.com/advisories/34297
http://security.gentoo.org/glsa/glsa-200710-07.xml
http://sourceforge.net/project/shownotes.php?release_id=541207
Patch
http://www.attrition.org/pipermail/vim/2007-October/001826.html
http://www.debian.org/security/2009/dsa-1743
http://www.mandriva.com/security/advisories?name=MDKSA-2007:200
http://www.redhat.com/support/errata/RHSA-2008-0136.html
http://www.securityfocus.com/bid/25826
http://www.ubuntu.com/usn/usn-529-1
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9540
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00261.html