{"id":"CVE-2014-9764","aliases":["DEBIAN-CVE-2014-9764","DLA-401-1","DSA-3537-1","EUVD-2014-9570","GHSA-qv5v-53gj-m57g","MGASA-2016-0049","SUSE-SU-2016:1481-1","UBUNTU-CVE-2014-9764","USN-3075-1"],"status":"published","title":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via...","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02709,"percentile":0.86079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-01-24T00:00:00Z","modified":"2026-10-23T16:02:07Z","fixes":[{"ecosystem":"Debian:12","package":"imlib2","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imlib2","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imlib2","fixed_in":["1.4.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","fixed_in":["1.4.6-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-8+deb6u1"}]}],"versions":["1.4.2-8"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u1"}]}],"versions":["1.4.5-1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2+deb8u1"}]}],"versions":["1.4.6-2"],"bundled":3},{"source":"osv","ecosystem":"Mageia:5","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2ubuntu0.1"}]}],"versions":["1.4.5-1ubuntu2","1.4.6-1","1.4.6-2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2ubuntu0.1"}]}],"versions":["1.4.5-1ubuntu2","1.4.6-1","1.4.6-2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1"}]}],"versions":["1.4.7-1","1.4.7-1build1"],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"enlightenment","product":"imlib2"}],"references":[{"url":"https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/90962","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201611-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3537","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://git.enlightenment.org/legacy/imlib2.git/commit/?h=v1.4.7\u0026id=1f9b0b32728803a1578e658cd0955df773e34f49","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9764"},{"url":"https://github.com/advisories/GHSA-qv5v-53gj-m57g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9764","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0049.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17594","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/01/22/6","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161481-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/963797","tags":["report"]},{"url":"https://bugzilla.suse.com/963800","tags":["report"]},{"url":"https://bugzilla.suse.com/973759","tags":["report"]},{"url":"https://bugzilla.suse.com/973761","tags":["report"]},{"url":"https://bugzilla.suse.com/974202","tags":["report"]},{"url":"https://bugzilla.suse.com/977538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-5326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3994","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-9764","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3075-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2011-5326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4024","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9764","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.","status":"published","published":"2016-05-13T16:00:00Z","modified":"2024-08-06T13:55:04.356Z","updated_at":"2026-11-02T14:33:42.882687Z"}],"euvd":[{"id":"EUVD-2014-9570","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.","status":"published","published":"2016-05-13T16:00:00Z","modified":"2024-08-06T13:55:04Z","updated_at":"2026-11-03T01:56:47.945236Z"}],"ghsa":[{"id":"GHSA-qv5v-53gj-m57g","title":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via...","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.","status":"published","published":"2022-05-17T02:38:53Z","modified":"2023-01-27T05:05:23Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:42:40.834674Z"}],"nvd":[{"id":"CVE-2014-9764","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.","status":"published","published":"2016-05-13T16:59:03.563Z","modified":"2026-06-17T00:18:57.117Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"CVE-2014-9764","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.","status":"published","published":"2016-05-13T16:59:03Z","modified":"2026-04-16T06:15:37.683358333Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9764","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.","status":"published","published":"2016-05-13T16:59:03.563Z","modified":"2026-10-23T16:02:07.146759262Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-9764","description":"imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file.","status":"published","published":"2016-05-13T00:00:00Z","modified":"2026-04-22T09:57:47.183669Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"DLA-401-1","title":"imlib2 - security update","status":"published","published":"2016-01-24T00:00:00Z","modified":"2026-03-09T01:18:48.298154Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-3537-1","title":"imlib2 - security update","status":"published","published":"2016-03-31T00:00:00Z","modified":"2026-03-09T01:22:06.791069Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0049","title":"Updated imlib2 packages fix security vulnerability","description":"Various issues in imlib before 1.4.7 in the GIF loader (CVE-2014-9762,\nCVE-2014-9764) and PNM loader (CVE-2014-9763) could cause crashes.\n\nThe imlib2 package has been updated to version 1.4.7, fixing these issues\nand several other bugs.\n","status":"published","published":"2016-02-05T17:26:09Z","modified":"2026-04-16T06:24:08.169588923Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"SUSE-SU-2016:1481-1","title":"Security update for imlib2","description":"\nThis update for imlib2 fixes the following issues: \n\nSecurity issues fixed:\n- CVE-2016-3994: Potential DOS in giflib loader (bsc#973759)\n- CVE-2016-3993: Off buy 1 in merge update (bsc#973761)\n- CVE-2014-9764: fix segmentation fault when opening specifically crafted input (bsc#963797)\n- CVE-2014-9763: Prevent division-by-zero crashes (bsc#963800)\n- CVE-2011-5326: Ellipse of width 1 triggers crashes (bsc#974202)\n\nBugs fixed:\n- bsc#977538: Fix various potential crashes","status":"published","published":"2016-06-03T07:38:48Z","modified":"2026-02-04T04:34:50.670638Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3075-1","title":"imlib2 vulnerabilities","description":"Jakub Wilk discovered an out of bounds read in the GIF loader\nimplementation in Imlib2. An attacker could use this to cause a\ndenial of service (application crash) or possibly obtain sensitive\ninformation. (CVE-2016-3994)\n\nYuriy M. Kaminskiy discovered an off-by-one error when handling\ncoordinates in Imlib2. An attacker could use this to cause a denial of\nservice (application crash). (CVE-2016-3993)\n\nYuriy M. Kaminskiy discovered that integer overflows existed in Imlib2\nwhen handling images with large dimensions. An attacker could use\nthis to cause a denial of service (memory exhaustion or application\ncrash). (CVE-2014-9771, CVE-2016-4024)\n\nKevin Ryde discovered that the ellipse drawing code in Imlib2 would\nattempt to divide by zero when drawing a 2x1 ellipse. An attacker\ncould use this to cause a denial of service (application crash).\n(CVE-2011-5326)\n\nIt was discovered that Imlib2 did not properly handled GIF images\nwithout colormaps. An attacker could use this to cause a denial of\nservice (application crash). This issue only affected Ubuntu 12.04 LTS\nand Ubuntu 14.04 LTS. (CVE-2014-9762)\n\nIt was discovered that Imlib2 did not properly handle some PNM images,\nleading to a division by zero. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)\n\nIt was discovered that Imlib2 did not properly handle error conditions\nwhen loading some GIF images. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)\n","status":"published","published":"2016-09-09T03:48:22Z","modified":"2026-04-22T09:28:35.945408Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}