CVE-2020-12761 Integer overflow in n/a

Critical 9.1 Published 9 May 2020 Updated 4 Aug 2024

An integer overflow in imlib2 allows attackers to cause invalid memory allocations and out-of-bounds reads via a crafted icon file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-12761?

CVE-2020-12761 is a critical vulnerability in n/a, published on 9 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer overflow (with resultant invalid memory allocations and out-of-bounds reads) via an icon with many colors in its color map.

Weakness: CWE-190, CWE-125

Which versions are affected by CVE-2020-12761?

It affects 1 product.

Linux distribution packages (1)

imlib2 openSUSE:Tumbleweed All versions 1.11.1-2.1

Products include Enlightenment Imlib2.

How do I fix CVE-2020-12761?

Apply the vendor's patch.

Is CVE-2020-12761 being exploited?

There is no known exploitation of CVE-2020-12761 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2020-12761, GHSA-4fv4-55mw-p3v4, UBUNTU-CVE-2020-12761, USN-5099-1, openSUSE-SU-2024:13010-1.