Unscored severity · published Aug 5, 2009
CVE-2009-2688
Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4.22, when running on Windows, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via…
–
CVSS
8.6%
EPSS
No
On KEV
Description
Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4.22, when running on Windows, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) the tiff_instantiate function processing a crafted TIFF file, (2) the png_instantiate function processing a crafted PNG file, and (3) the jpeg_instantiate function processing a crafted JPEG file, all which trigger a heap-based buffer overflow. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XE
Xemacs · Xemacs
21.4.22 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2688
osvdb.org
http://osvdb.org/55298
Vendor Advisory
http://secunia.com/advisories/35348
tracker.xemacs.org
http://tracker.xemacs.org/XEmacs/its/issue534
www.securityfocus.com
http://www.securityfocus.com/bid/35473
Vendor Advisory
http://www.vupen.com/english/advisories/2009/1666
bugs.gentoo.org
https://bugs.gentoo.org/show_bug.cgi?id=275397
More from Xemacs
–
CVE-2001-1301
rcs2log, as used in Emacs 20.4, xemacs 21.1.10 and other versions before 21.4, and possibly other packages, allows local users to modify files of other users via a symlink attack…