Tielei Wang has discovered two vulnerabilities in RenRen Talk, which can be exploited by malicious people to compromise a user's system.

1) A signedness error when validating image dimensions of skin files can be exploited to cause a heap-based buffer overflow via e.g. a specially crafted BMP file.

Successful exploitation of this vulnerability may allow execution of arbitrary code, but requires tricking a user into configuring a new skin using a malicious image file.

2) An error when processing images within a chat can be exploited to cause a heap-based buffer overflow by sending e.g. a specially crafted PNG file.

Successful exploitation of this vulnerability may allow execution of arbitrary code, but requires a victim to be an accepted contact on a buddy list.

The vulnerabilities are confirmed in version 2.9. Other versions may also be affected.

Solution
Do not use images from untrusted sources as skin files. Do not chat with untrusted contacts.

Provided and/or discovered by
Tielei Wang via Secunia.

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers