FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

xv -- exploitable buffer overflows

Affected packages
xv < 3.10a_4
xv-m17n < 3.10a_4


VuXML ID fffacc93-16cb-11d9-bc4a-000c41e2cdad
Discovery 2004-08-20
Entry 2004-10-05
Modified 2004-10-12

In a Bugtraq posting, infamous41md(at) reported:

there are at least 5 exploitable buffer and heap overflows in the image handling code. this allows someone to craft a malicious image, trick a user into viewing the file in xv, and upon viewing that image execute arbitrary code under privileges of the user viewing image. note the AT LEAST part of the above sentence. there is such a plethora of bad code that I just stopped reading after a while. there are at least 100 calls to sprintf() and strcpy() with no regards for bounds of buffers. 95% of these deal with program arguments or filenames, so they are of no interest to exploit. however I just got sick of reading this code after not too long. so im sure there are still other overflows in the image handling code for other image types.

The posting also included an exploit.