Heap-based buffer overflow in gdk-pixbuf
Summary
DLA-450-1: gdk-pixbuf - security update. Affects gdk-pixbuf versions < 2.26.1-1+deb7u4. Fixed in 2.26.1-1+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gdk-pixbuf is a library for image loading and saving facilities, fast scaling and compositing of pixbufs. It is used in various applications to handle image processing and rendering. However, a vulnerability has been discovered in gdk-pixbuf that allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
Vulnerability Detail
The vulnerability, identified as CVE-2015-7552, is a heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c. This vulnerability can be exploited by remote attackers through a specially crafted BMP file. By exploiting this vulnerability, an attacker can cause a denial of service or potentially execute arbitrary code on the affected system. Additionally, this update also fixes an incomplete patch for CVE-2015-7674, which is an integer overflow vulnerability in the pixops_scale_nearest function in pixops/pixops.c that allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted GIF image file, triggering a heap-based buffer overflow.
How To Fix
Minimum fixed version
2.26.1-1+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gdk-pixbufTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The gdk-pixbuf library is vulnerable to a heap-based buffer overflow, which can be exploited by remote attackers to cause a denial of service or potentially execute arbitrary code. To mitigate this vulnerability, it is crucial to upgrade the gdk-pixbuf package to version 2.26.1-1+deb7u4 or later. For further assistance, you can contact DevNack.com.
See every vulnerability recorded for gdk-pixbuf →
FAQ
gdk-pixbuf is a library for image loading and saving facilities, fast scaling and compositing of pixbufs. It is commonly used in applications for handling image processing and rendering.
The vulnerability allows remote attackers to cause a denial of service or potentially execute arbitrary code on the affected system. This can lead to system instability, data loss, or unauthorized access.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the moment, there is no known workaround for this vulnerability. It is recommended to apply the provided fix by upgrading the gdk-pixbuf package.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for gdk-pixbuf.
