Heap Overflow in gdk-pixbuf
Summary
DSA-3337-2: gdk-pixbuf - security update. Affects gdk-pixbuf versions < 2.26.1-1+deb7u3. Fixed in 2.26.1-1+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gdk-pixbuf is a library for image loading and manipulation in the GNOME desktop environment. It provides a set of functions for handling various image formats. This vulnerability affects versions 2.26.1-1+deb7u3 and earlier in Debian 7 (wheezy), and versions 2.31.1-2+deb8u4 and earlier in Debian 8 (jessie).
Vulnerability Detail
A heap overflow vulnerability has been discovered in gdk-pixbuf's processing of BMP images. If a malformed BMP image is opened, this vulnerability may allow an attacker to execute arbitrary code on the affected system.
How To Fix
Minimum fixed version
2.26.1-1+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gdk-pixbufTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
It is crucial to upgrade the gdk-pixbuf package to the fixed versions to mitigate the risk of arbitrary code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gdk-pixbuf →
FAQ
gdk-pixbuf is a library for image loading and manipulation in the GNOME desktop environment. It provides a set of functions for handling various image formats.
Versions 2.26.1-1+deb7u3 and earlier in Debian 7 (wheezy), and versions 2.31.1-2+deb8u4 and earlier in Debian 8 (jessie) are affected.
If a malformed BMP image is opened using gdk-pixbuf, an attacker may be able to execute arbitrary code on the affected system.
To fix this vulnerability, upgrade the gdk-pixbuf package to the recommended versions mentioned earlier.
No, there is no known workaround for this vulnerability at this time.
Related vulnerabilities
Recent vulnerabilities recorded for gdk-pixbuf.
