{"id":"CVE-2011-5326","aliases":["DEBIAN-CVE-2011-5326","DSA-3555-1","EUVD-2011-5225","GHSA-77x3-x4m9-mrmq","MGASA-2016-0140","SUSE-SU-2016:1481-1","UBUNTU-CVE-2011-5326","USN-3075-1"],"status":"published","title":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error...","description":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02533,"percentile":0.85033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2016-04-13T17:39:04Z","modified":"2026-10-23T18:02:49Z","fixes":[{"ecosystem":"Debian:12","package":"imlib2","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imlib2","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imlib2","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","fixed_in":["1.4.6-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"imlib2","fixed_in":["1.4.7-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u2"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2+deb8u2"}]}],"versions":["1.4.6-2","1.4.6-2+deb8u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2ubuntu0.1"}]}],"versions":["1.4.5-1ubuntu2","1.4.6-1","1.4.6-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1"}]}],"versions":["1.4.7-1","1.4.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2ubuntu0.1"}]}],"versions":["1.4.5-1ubuntu2","1.4.6-1","1.4.6-2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1"}]}],"versions":["1.4.7-1","1.4.7-1build1"],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"enlightenment","product":"imlib2"}],"references":[{"url":"https://git.enlightenment.org/legacy/imlib2.git/commit/?id=c94d83ccab15d5ef02f88d42dce38ed3f0892882","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://sourceforge.net/p/enlightenment/mailman/message/35055012/","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3555","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=639414","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-5326"},{"url":"https://sourceforge.net/p/enlightenment/mailman/message/35055012"},{"url":"https://github.com/advisories/GHSA-77x3-x4m9-mrmq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-5326","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0140.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18183","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/04/10/3","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/04/10/4","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/04/11/1","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161481-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/963797","tags":["report"]},{"url":"https://bugzilla.suse.com/963800","tags":["report"]},{"url":"https://bugzilla.suse.com/973759","tags":["report"]},{"url":"https://bugzilla.suse.com/973761","tags":["report"]},{"url":"https://bugzilla.suse.com/974202","tags":["report"]},{"url":"https://bugzilla.suse.com/977538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-5326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3994","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2011-5326","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/04/10/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3075-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-5326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4024","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2011-5326","description":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.","status":"published","published":"2016-05-13T16:00:00Z","modified":"2024-08-07T00:30:47.064Z","updated_at":"2026-11-02T14:35:36.252742Z"}],"euvd":[{"id":"EUVD-2011-5225","description":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.","status":"published","published":"2016-05-13T16:00:00Z","modified":"2024-08-07T00:30:47Z","updated_at":"2026-11-03T01:39:46.783649Z"}],"ghsa":[{"id":"GHSA-77x3-x4m9-mrmq","title":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error...","description":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.","status":"published","published":"2022-05-17T03:37:20Z","modified":"2025-04-12T13:01:00Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:27.480327Z"}],"nvd":[{"id":"CVE-2011-5326","description":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.","status":"published","published":"2016-05-13T16:59:00.14Z","modified":"2026-06-16T23:36:21.733Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:12.639283Z"}],"osv":[{"id":"CVE-2011-5326","description":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.","status":"published","published":"2016-05-13T16:59:00Z","modified":"2026-04-16T06:20:01.588381072Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-5326","description":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.","status":"published","published":"2016-05-13T16:59:00.14Z","modified":"2026-10-23T18:02:49.855959321Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:24.92418Z"},{"id":"UBUNTU-CVE-2011-5326","description":"imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.","status":"published","published":"2016-05-13T00:00:00Z","modified":"2026-04-22T09:10:34.981127Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:06.395274Z"},{"id":"DSA-3555-1","title":"imlib2 - security update","status":"published","published":"2016-04-23T00:00:00Z","modified":"2026-03-09T01:23:06.791998Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0140","title":"Updated imlib2 packages fix security vulnerabilities","description":"Updated imlib2 packages fix security vulnerabilities:\n\nAn out-of-bounds read caused by an off-by-one error in __imlib_MergeUpdate()\nin src/lib/updates.c in imlib2 1.4.8 and earlier (CVE-2016-3993).\n\nAn out-of-bounds read from colormap in the GIF loader in imlib2 1.4.8 and\nearlier can result in denial of service and potential host memory exposure\n(CVE-2016-3994).\n\nAttempting to draw a 2x1 ellipse with e.g. imlib_image_draw_ellipse(x, y, 2, 1)\ncauses a divide-by-zero in imlib2 1.4.8 and earlier, resulting in a denial of\nservice if an application uses the draw command with untrusted input\n(CVE-2011-5326).\n","status":"published","published":"2016-04-13T17:39:04Z","modified":"2026-04-16T06:26:04.766835413Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"SUSE-SU-2016:1481-1","title":"Security update for imlib2","description":"\nThis update for imlib2 fixes the following issues: \n\nSecurity issues fixed:\n- CVE-2016-3994: Potential DOS in giflib loader (bsc#973759)\n- CVE-2016-3993: Off buy 1 in merge update (bsc#973761)\n- CVE-2014-9764: fix segmentation fault when opening specifically crafted input (bsc#963797)\n- CVE-2014-9763: Prevent division-by-zero crashes (bsc#963800)\n- CVE-2011-5326: Ellipse of width 1 triggers crashes (bsc#974202)\n\nBugs fixed:\n- bsc#977538: Fix various potential crashes","status":"published","published":"2016-06-03T07:38:48Z","modified":"2026-02-04T04:34:50.670638Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3075-1","title":"imlib2 vulnerabilities","description":"Jakub Wilk discovered an out of bounds read in the GIF loader\nimplementation in Imlib2. An attacker could use this to cause a\ndenial of service (application crash) or possibly obtain sensitive\ninformation. (CVE-2016-3994)\n\nYuriy M. Kaminskiy discovered an off-by-one error when handling\ncoordinates in Imlib2. An attacker could use this to cause a denial of\nservice (application crash). (CVE-2016-3993)\n\nYuriy M. Kaminskiy discovered that integer overflows existed in Imlib2\nwhen handling images with large dimensions. An attacker could use\nthis to cause a denial of service (memory exhaustion or application\ncrash). (CVE-2014-9771, CVE-2016-4024)\n\nKevin Ryde discovered that the ellipse drawing code in Imlib2 would\nattempt to divide by zero when drawing a 2x1 ellipse. An attacker\ncould use this to cause a denial of service (application crash).\n(CVE-2011-5326)\n\nIt was discovered that Imlib2 did not properly handled GIF images\nwithout colormaps. An attacker could use this to cause a denial of\nservice (application crash). This issue only affected Ubuntu 12.04 LTS\nand Ubuntu 14.04 LTS. (CVE-2014-9762)\n\nIt was discovered that Imlib2 did not properly handle some PNM images,\nleading to a division by zero. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)\n\nIt was discovered that Imlib2 did not properly handle error conditions\nwhen loading some GIF images. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)\n","status":"published","published":"2016-09-09T03:48:22Z","modified":"2026-04-22T09:28:35.945408Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}