CVE-2015-7507: 
Linux Debian vulnerability analysis and mitigation

libnsbmp.c in Libnsbmp 0.1.2 is a decoding library for BMP and ICO files, primarily developed and used as part of the NetSurf project. The vulnerability (CVE-2015-7507) allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table. The issue was disclosed on December 16, 2015 (NetSurf Disclosure).

The vulnerability occurs due to a lack of boundary checking before dereferencing bmp->colour_table in bmp_decode_rgb() and bmp_decode_rle() functions with an index based on user-supplied values. The out-of-bounds read can be triggered when processing BMP files with specially crafted color table values (NetSurf Disclosure).

The vulnerability allows attackers to cause a denial of service condition through an out-of-bounds read, which can result in application crashes when processing maliciously crafted BMP files (NVD).

The vulnerability requires the attacker to provide a specially crafted BMP file with manipulated color table values to trigger the out-of-bounds read condition (NetSurf Disclosure).

The vulnerability was fixed in the git HEAD version of libnsbmp. Users should upgrade to the patched version to prevent exploitation (NetSurf Disclosure).