Integer Overflow Vulnerability in gdk-pixbuf: Denial of Service Risk
Summary
ALPINE-CVE-2017-6312: Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file, which triggers an out... Affects gdk-pixbuf versions < 2.36.6-r1. Fixed in 2.36.6-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gdk-pixbuf is a library used for loading and manipulating images in various formats, widely utilized in graphical applications. It provides essential functionalities for image processing, including support for multiple file formats and efficient memory management. However, it is susceptible to vulnerabilities that can lead to application crashes or unexpected behavior, particularly when handling malformed image files.
Vulnerability Detail
The vulnerability identified as CVE-2017-6312 is an integer overflow issue located in the io-ico.c file of gdk-pixbuf. This flaw allows attackers to craft malicious ICO files that, when processed, can trigger an out-of-bounds read, leading to a segmentation fault and application crash. The vulnerability arises from improper handling of image entry offsets, which can be exploited to cause denial of service. The CVSS score for this vulnerability is 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.36.6-r1
This is the first release that contains the fix.
sudo apk add --upgrade gdk-pixbufTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to check the integrity of ICO files before processing them. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
The integer overflow vulnerability in gdk-pixbuf poses a significant risk of denial of service through crafted ICO files. Users are strongly advised to update to the patched version to mitigate this risk. For those unable to update immediately, implementing input validation can serve as a temporary workaround. Regular monitoring of vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for gdk-pixbuf →
FAQ
CVE-2017-6312 is a vulnerability in gdk-pixbuf that can lead to denial of service through integer overflow when processing malformed ICO files.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can result in application crashes, leading to denial of service and potential disruption of services relying on gdk-pixbuf.
Yes, updating gdk-pixbuf to version 2.36.6-r1 or later will permanently fix the vulnerability.
If an immediate update is not possible, implement input validation for ICO files to reduce the risk of exploitation until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for gdk-pixbuf.
