Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2008-5263: ksquirrel-libs 0.8.0 may execute code from .hdr files

CVE-2008-5263 · published 17 years ago

Summary

The ksquirrel-libs library version 0.8.0 can be tricked by a specially crafted Radiance RGBE (.hdr) image to run any program the attacker chooses. This could let an attacker take control of the computer that processes such images. Update to a newer version of ksquirrel-libs or stop using .hdr files until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dmitry_baryshev	ksquirrel-libs	0.8.0 `cpe:2.3:a:dmitry_baryshev:ksquirrel-libs:0.8.0:::::::*`

Original advisory text

Multiple stack-based buffer overflows in the mt_codec::getHdrHead function in kernel/kls_hdr/fmt_codec_hdr.cpp in ksquirrel-libs 0.8.0 allow context-dependent attackers to execute arbitrary code vi...

References

http://secunia.com/advisories/33469 Vendor Advisory
http://secunia.com/secunia_research/2008-63/ Vendor Advisory
http://www.securityfocus.com/archive/1/501228/100/0/threaded
http://www.securityfocus.com/bid/33902
http://www.vupen.com/english/advisories/2009/0528 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48901

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.8 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published26 Feb 2009

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2008-5263 · NVD

Track software like this

Free during beta