{"id":"CVE-2016-4024","aliases":["DEBIAN-CVE-2016-4024","DSA-3555-1","EUVD-2016-5030","GHSA-w45c-xqv7-2g36","MGASA-2016-0144","UBUNTU-CVE-2016-4024","USN-3075-1"],"status":"published","title":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute...","description":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05502,"percentile":0.92842,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-04-21T14:52:25Z","modified":"2026-09-22T07:03:06Z","fixes":[{"ecosystem":"Debian:12","package":"imlib2","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imlib2","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imlib2","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"imlib2","fixed_in":["1.4.8-1.1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","fixed_in":["1.4.6-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"imlib2","fixed_in":["1.4.7-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u2"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2+deb8u2"}]}],"versions":["1.4.6-2","1.4.6-2+deb8u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2ubuntu0.1"}]}],"versions":["1.4.5-1ubuntu2","1.4.6-1","1.4.6-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1"}]}],"versions":["1.4.7-1","1.4.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-2ubuntu0.1"}]}],"versions":["1.4.5-1ubuntu2","1.4.6-1","1.4.6-2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"imlib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1"}]}],"versions":["1.4.7-1","1.4.7-1build1"],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"enlightenment","product":"imlib2"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"https://git.enlightenment.org/legacy/imlib2.git/commit/?id=7eba2e4c8ac0e20838947f10f29d0efe1add8227","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://sourceforge.net/p/enlightenment/mailman/message/35055012/","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/201611-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3555","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1035573","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/86073","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4024"},{"url":"https://sourceforge.net/p/enlightenment/mailman/message/35055012"},{"url":"https://github.com/advisories/GHSA-w45c-xqv7-2g36"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4024","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0144.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18210","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/04/14/8","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4024","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/04/14/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3075-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2011-5326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3994","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4024","description":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.","status":"published","published":"2016-05-13T16:00:00Z","modified":"2024-08-06T00:17:30.684Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2016-5030","description":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.","status":"published","published":"2016-05-13T16:00:00Z","modified":"2024-08-06T00:17:30Z","updated_at":"2026-11-03T02:22:48.270082Z"}],"ghsa":[{"id":"GHSA-w45c-xqv7-2g36","title":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute...","description":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.","status":"published","published":"2022-05-14T02:05:03Z","modified":"2025-04-12T13:01:01Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:27.480327Z"}],"nvd":[{"id":"CVE-2016-4024","description":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.","status":"published","published":"2016-05-13T16:59:10.937Z","modified":"2026-06-17T00:46:45.127Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"CVE-2016-4024","description":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.","status":"published","published":"2016-05-13T16:59:10.937Z","modified":"2026-04-16T06:24:46.912861165Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4024","description":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.","status":"published","published":"2016-05-13T16:59:10.937Z","modified":"2026-09-22T07:03:06.23578482Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4024","description":"Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an image, which triggers an out-of-bounds heap memory write operation.","status":"published","published":"2016-05-13T00:00:00Z","modified":"2026-04-22T10:42:22.342723Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DSA-3555-1","title":"imlib2 - security update","status":"published","published":"2016-04-23T00:00:00Z","modified":"2026-03-09T01:23:06.791998Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0144","title":"Updated imlib2 packages fix CVE-2016-4024","description":"Updated imlib2 packages fix security vulnerability:\n\nInteger overflow in imlib2 1.4.8 on 32-bit machines leads to insufficient heap \nallocation and heap overwrite in many image loaders, potentially resulting in\nremote code execution (CVE-2016-4024).\n","status":"published","published":"2016-04-21T14:52:25Z","modified":"2026-04-16T06:25:45.586320563Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"USN-3075-1","title":"imlib2 vulnerabilities","description":"Jakub Wilk discovered an out of bounds read in the GIF loader\nimplementation in Imlib2. An attacker could use this to cause a\ndenial of service (application crash) or possibly obtain sensitive\ninformation. (CVE-2016-3994)\n\nYuriy M. Kaminskiy discovered an off-by-one error when handling\ncoordinates in Imlib2. An attacker could use this to cause a denial of\nservice (application crash). (CVE-2016-3993)\n\nYuriy M. Kaminskiy discovered that integer overflows existed in Imlib2\nwhen handling images with large dimensions. An attacker could use\nthis to cause a denial of service (memory exhaustion or application\ncrash). (CVE-2014-9771, CVE-2016-4024)\n\nKevin Ryde discovered that the ellipse drawing code in Imlib2 would\nattempt to divide by zero when drawing a 2x1 ellipse. An attacker\ncould use this to cause a denial of service (application crash).\n(CVE-2011-5326)\n\nIt was discovered that Imlib2 did not properly handled GIF images\nwithout colormaps. An attacker could use this to cause a denial of\nservice (application crash). This issue only affected Ubuntu 12.04 LTS\nand Ubuntu 14.04 LTS. (CVE-2014-9762)\n\nIt was discovered that Imlib2 did not properly handle some PNM images,\nleading to a division by zero. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)\n\nIt was discovered that Imlib2 did not properly handle error conditions\nwhen loading some GIF images. An attacker could use this to cause\na denial of service (application crash). This issue only affected\nUbuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)\n","status":"published","published":"2016-09-09T03:48:22Z","modified":"2026-04-22T09:28:35.945408Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}