CVE-2008-0986

CVE-2008-0986 describes an integer overflow in the Android libsgl.so BMP reader (BMP::readFromStream) used in Google Android SDK m3-rc37a and earlier, and m5-rc14. When the BMP header’s offset field is negative and the DIB header specifies 8 bpp, the parser allocates a palette using the negative ...

CVE-2008-0985

CVE-2008-0985 describes a heap-based overflow in the GIF handling in Android’s WebKit/WebCore stack (GIFImageDecoder) used by the Android SDK m3-rc37a and earlier. The root cause is miscalculation of image size based on the GIF header’s Logical Screen Width/Height, leading to buffer overflows whe...