FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2010-1513

This CVE name corresponds to:

Entered	Topic
2010-05-28	ziproxy -- atypical huge picture files vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2010-1513 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2010-1513
Phase	Assigned(20100426)

Description

Multiple integer overflows in src/image.c in Ziproxy before 3.0.1 allow remote attackers to execute arbitrary code via (1) a large JPG image, related to the jpg2bitmap function or (2) a large PNG image, related to the png2bitmap function, leading to heap-based buffer overflows.

References

Source	Reference
BUGTRAQ	20100524 Secunia Research: Ziproxy Two Integer Overflow Vulnerabilities
MISC	http://secunia.com/secunia_research/2010-75/
CONFIRM	http://ziproxy.sourceforge.net/#news
SECUNIA	39941