7.5
CVSSv2

CVE-2006-1060

Published: 11/04/2006 Updated: 20/07/2017
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

Heap-based buffer overflow in zgv prior to 5.8 and xzgv prior to 0.8 might allow user-assisted malicious users to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or YCCK color space, which causes less memory to be allocated than required.

Vulnerable Product Search on Vulmon Subscribe to Product

xzgv xzgv

Vendor Advisories

Debian Bug report logs - #362288 xzgv: exploitable buffer overflow with crafted JPEG images [CVE-2006-1060] Package: xzgv; Maintainer for xzgv is Theodore Y Ts'o <tytso@mitedu>; Source for xzgv is src:xzgv (PTS, buildd, popcon) Reported by: Martin Pitt <martinpitt@canonicalcom> Date: Thu, 13 Apr 2006 08:03:02 UTC ...
Andrea Barisani discovered that zgv, an svgalib graphics viewer, attempts to decode JPEG images within the CMYK/YCCK colour space incorrectly, which could lead to the execution of arbitrary code For the old stable distribution (woody) this problem has been fixed in version 55-3woody3 For the stable distribution (sarge) this problem has been fixe ...