Libdisplay Info
Monthly
Heap out-of-bounds read in libdisplay-info 0.4.0's DisplayID v2 parser lets a crafted EDID over-advance the parse cursor and crash the consuming application. The vulnerable path is reachable when an application parses attacker-controlled EDID data supplied through a malicious monitor, KVM, capture device, or crafted file, requiring local access and passive user interaction. This is a medium-severity denial-of-service issue, not a critical priority, with no code execution or confidentiality impact and no public exploit identified at time of analysis.
Heap out-of-bounds read in libdisplay-info through 0.4.0 lets a crafted EDID trigger a crash in applications that parse it. The bug is in the DisplayID v1 section parser in displayid.c, where a data block's declared length can exceed the section and drive is_all_zeroes past the heap buffer; delivery is local/physical via a malicious monitor, KVM, capture device, or crafted EDID file and requires passive user interaction. Impact is limited to denial of service (availability only), and no public exploit was identified at time of analysis.
Heap out-of-bounds read in libdisplay-info 0.4.0's DisplayID v2 parser lets a crafted EDID over-advance the parse cursor and crash the consuming application. The vulnerable path is reachable when an application parses attacker-controlled EDID data supplied through a malicious monitor, KVM, capture device, or crafted file, requiring local access and passive user interaction. This is a medium-severity denial-of-service issue, not a critical priority, with no code execution or confidentiality impact and no public exploit identified at time of analysis.
Heap out-of-bounds read in libdisplay-info through 0.4.0 lets a crafted EDID trigger a crash in applications that parse it. The bug is in the DisplayID v1 section parser in displayid.c, where a data block's declared length can exceed the section and drive is_all_zeroes past the heap buffer; delivery is local/physical via a malicious monitor, KVM, capture device, or crafted EDID file and requires passive user interaction. Impact is limited to denial of service (availability only), and no public exploit was identified at time of analysis.