{"id":"CVE-2014-9762","aliases":["DEBIAN-CVE-2014-9762","DLA-401-1","DSA-3537-1","EUVD-2014-9568","GHSA-jvw3-37h6-2qm9","MGASA-2016-0049","UBUNTU-CVE-2014-9762","USN-3075-1","openSUSE-SU-2024:10425-1"],"status":"published","title":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via...","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02709,"percentile":0.86079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-01-24T00:00:00Z","modified":"2026-10-23T16:02:07Z","fixes":[{"ecosystem":"Debian:12","package":"imlib2","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imlib2","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imlib2","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","fixed_in":["1.4.6-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-8+deb6u1"}]}],"versions":["1.4.2-8"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u1"}]}],"versions":["1.4.5-1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2+deb8u1"}]}],"versions":["1.4.6-2"],"bundled":3},{"source":"osv","ecosystem":"Mageia:5","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2ubuntu0.1"}]}],"versions":["1.4.5-1ubuntu2","1.4.6-1","1.4.6-2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2ubuntu0.1"}]}],"versions":["1.4.5-1ubuntu2","1.4.6-1","1.4.6-2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1"}]}],"versions":["1.4.7-1","1.4.7-1build1"],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"enlightenment","product":"imlib2"}],"references":[{"url":"https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201611-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3537","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://git.enlightenment.org/legacy/imlib2.git/commit/?h=v1.4.7\u0026id=39641e74a560982fbf93f29bf96b37d27803cb56","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/90959","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9762"},{"url":"https://github.com/advisories/GHSA-jvw3-37h6-2qm9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9762","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0049.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17594","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/01/22/6","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-9762","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3075-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2011-5326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4024","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9762","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-9762","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.","status":"published","published":"2016-05-13T16:00:00Z","modified":"2024-08-06T13:55:04.735Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9568","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.","status":"published","published":"2016-05-13T16:00:00Z","modified":"2024-08-06T13:55:04Z","updated_at":"2026-11-03T01:56:47.945236Z"}],"ghsa":[{"id":"GHSA-jvw3-37h6-2qm9","title":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via...","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.","status":"published","published":"2022-05-17T02:38:53Z","modified":"2023-01-27T05:05:56Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:42:48.225805Z"}],"nvd":[{"id":"CVE-2014-9762","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.","status":"published","published":"2016-05-13T16:59:01.327Z","modified":"2026-06-17T00:18:56.88Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"CVE-2014-9762","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.","status":"published","published":"2016-05-13T16:59:01Z","modified":"2026-04-16T06:20:25.800005981Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9762","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.","status":"published","published":"2016-05-13T16:59:01.327Z","modified":"2026-10-23T16:02:07.178301334Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-9762","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.","status":"published","published":"2016-05-13T00:00:00Z","modified":"2026-04-22T09:57:58.171854Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"DLA-401-1","title":"imlib2 - security update","status":"published","published":"2016-01-24T00:00:00Z","modified":"2026-03-09T01:18:48.298154Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-3537-1","title":"imlib2 - security update","status":"published","published":"2016-03-31T00:00:00Z","modified":"2026-03-09T01:22:06.791069Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0049","title":"Updated imlib2 packages fix security vulnerability","description":"Various issues in imlib before 1.4.7 in the GIF loader (CVE-2014-9762,\nCVE-2014-9764) and PNM loader (CVE-2014-9763) could cause crashes.\n\nThe imlib2 package has been updated to version 1.4.7, fixing these issues\nand several other bugs.\n","status":"published","published":"2016-02-05T17:26:09Z","modified":"2026-04-16T06:24:08.169588923Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10425-1","title":"edje-1.18.2-5.1 on GA media","description":"These are all security issues fixed in the edje-1.18.2-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:25.382646Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-3075-1","title":"imlib2 vulnerabilities","description":"Jakub Wilk discovered an out of bounds read in the GIF loader\nimplementation in Imlib2. An attacker could use this to cause a\ndenial of service (application crash) or possibly obtain sensitive\ninformation. (CVE-2016-3994)\n\nYuriy M. Kaminskiy discovered an off-by-one error when handling\ncoordinates in Imlib2. An attacker could use this to cause a denial of\nservice (application crash). (CVE-2016-3993)\n\nYuriy M. Kaminskiy discovered that integer overflows existed in Imlib2\nwhen handling images with large dimensions. An attacker could use\nthis to cause a denial of service (memory exhaustion or application\ncrash). (CVE-2014-9771, CVE-2016-4024)\n\nKevin Ryde discovered that the ellipse drawing code in Imlib2 would\nattempt to divide by zero when drawing a 2x1 ellipse. An attacker\ncould use this to cause a denial of service (application crash).\n(CVE-2011-5326)\n\nIt was discovered that Imlib2 did not properly handled GIF images\nwithout colormaps. An attacker could use this to cause a denial of\nservice (application crash). This issue only affected Ubuntu 12.04 LTS\nand Ubuntu 14.04 LTS. (CVE-2014-9762)\n\nIt was discovered that Imlib2 did not properly handle some PNM images,\nleading to a division by zero. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)\n\nIt was discovered that Imlib2 did not properly handle error conditions\nwhen loading some GIF images. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)\n","status":"published","published":"2016-09-09T03:48:22Z","modified":"2026-04-22T09:28:35.945408Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}