CVE-2008-4864

Multiple integer overflows in imageop.c

• CVSS 7.5
• CWE-190 Integer Overflow or Wraparound
• Numeric Errors
• Local

Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in certain arguments to the crop function, leading to a buffer overflow, a different vulnerability than CVE-2007-4965 and CVE-2008-1679.

CVE

CVE-2008-4864

CWE

CWE-190 Integer Overflow or Wraparound

CVSS base score

7.5

Published

2008-11-01

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Numeric Errors

Subcategory

Integer Overflows

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Upgrade to Python 2.5.2 or higher.

from PIL import Image

def crop(image, box):
    left, upper, right, lower = box
    return image.crop(box)

if __name__ == "__main__":
    img = Image.open("example.jpg")
    crop_box = (0, 0, 1000000000, 1000000000)
    cropped_image = crop(img, crop_box)
    cropped_image.show()

import sys
from PIL import Image

def crop(image, box):
    if any(not isinstance(coord, int) or coord < 0 for coord in box):
        raise ValueError("Coordinates must be non-negative integers.")
    
    width, height = image.size
    left, upper, right, lower = box
    
    if left >= right or upper >= lower or right > width or lower > height:
        raise ValueError("Invalid crop box dimensions.")
    
    return image.crop(box)

if __name__ == "__main__":
    img = Image.open("example.jpg")
    crop_box = (0, 0, 100, 100)
    cropped_image = crop(img, crop_box)
    cropped_image.show()

@misc{vaitp:cve20084864,
  title        = {{Multiple integer overflows in imageop.c}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2008},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2008-4864},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2008-4864/}}
}