CVE-2016-3993

Name of the Vulnerable Software and Affected Versions imlib2 versions prior to 1.4.9

Description The issue is caused by an off-by-one error in the imlib MergeUpdate function, allowing remote attackers to cause a denial of service through crafted coordinates, resulting in an out-of-bounds read and application crash.

Recommendations For versions prior to 1.4.9, update to version 1.4.9 or later to resolve the issue. As a temporary workaround, consider restricting the input of coordinates to prevent crafted values from being processed by the imlib MergeUpdate function.