Denial of Service Vulnerability in Eye of GNOME (eog) Due to Invalid UTF-8 Handling
Summary
DEBIAN-CVE-2016-6855: Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via ve... Affects eog versions < 3.20.4-1. Fixed in 3.20.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Eye of GNOME (eog) is an image viewer for the GNOME desktop environment, designed to provide a simple and user-friendly interface for viewing images. It supports various image formats and offers features such as zooming, rotating, and basic editing. However, certain versions of eog are vulnerable to a denial of service attack when used with glib versions prior to 2.44.1, allowing attackers to exploit the application through malformed UTF-8 input.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2016-6855 affects Eye of GNOME (eog) versions 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4. When eog processes invalid UTF-8 data, it can lead to an out-of-bounds write, causing the application to crash. This vulnerability can be exploited by remote attackers, potentially leading to service disruption and denial of access to users.
How To Fix
Minimum fixed version
3.20.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade eogTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid opening images from untrusted sources that may contain invalid UTF-8 data. Additionally, ensure that your glib library is updated to version 2.44.1 or later to mitigate the risk.
Conclusion
The Eye of GNOME (eog) vulnerability DEBIAN-CVE-2016-6855 poses a significant risk of denial of service due to improper handling of invalid UTF-8 input. It is crucial for users to update to the patched version to ensure the security and stability of their applications.
See every vulnerability recorded for eog →
FAQ
The vulnerability can lead to a denial of service, causing the Eye of GNOME application to crash when processing invalid UTF-8 input.
Affected versions include eog 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
As a temporary measure, avoid opening images from untrusted sources and ensure your glib library is updated to version 2.44.1 or later.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2016-6855.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for eog.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
