CVE-2018-13794
📋 TL;DR
A heap-based buffer overflow vulnerability in the stb_image.h library used by catimg allows attackers to execute arbitrary code or cause denial of service. This affects catimg 2.4.0 users who process malicious BMP image files. The vulnerability is in the image parsing component and can be triggered when displaying images.
💻 Affected Systems
- catimg
📦 What is this software?
Catimg by Catimg Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the catimg process, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) when processing specially crafted BMP files.
If Mitigated
Limited impact if catimg runs in sandboxed environment with minimal privileges.
🎯 Exploit Status
Exploitation requires crafting a malicious BMP file that triggers the buffer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.0 and later
Vendor Advisory: https://github.com/posva/catimg/issues/34
Restart Required: No
Instructions:
1. Update catimg to version 2.5.0 or later using your package manager. 2. For manual installation: git clone https://github.com/posva/catimg.git, cd catimg, git checkout tags/2.5.0, make, sudo make install.
🔧 Temporary Workarounds
Disable BMP processing
allModify catimg source to disable BMP file support
Edit stb_image.h to remove BMP parsing functions
Use alternative image viewer
linuxTemporarily replace catimg with another terminal image viewer
sudo apt-get install fim
sudo yum install fim
🧯 If You Can't Patch
- Run catimg with reduced privileges using chroot or containerization
- Implement strict file validation for BMP files before processing with catimg
🔍 How to Verify
Check if Vulnerable:
Run 'catimg --version' and check if output shows 2.4.0Check Version:
catimg --versionVerify Fix Applied:
After update, run 'catimg --version' and confirm version is 2.5.0 or higher📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors from catimg process
- Abnormal termination of catimg
Network Indicators:
- Unusual file downloads followed by catimg execution
SIEM Query:
process_name:"catimg" AND (event_type:"crash" OR exit_code:139)