CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
90.2%
Package : gdk-pixbuf
Version : 2.26.1-1+deb7u4
CVE ID : CVE-2015-7552 CVE-2015-7674
A heap-based buffer overflow has been discovered in gdk-pixbuf, a
library for image loading and saving facilities, fast scaling and
compositing of pixbufs, that allows remote attackers to cause a denial
of service or possibly execute arbitrary code via a crafted BMP file.
This update also fixes an incomplete patch for CVE-2015-7674.
CVE-2015-7552
Heap-based buffer overflow in the gdk_pixbuf_flip function in
gdk-pixbuf-scale.c in gdk-pixbuf allows remote attackers to cause a
denial of service or possibly execute arbitrary code via a crafted
BMP file.
CVE-2015-7674
Integer overflow in the pixops_scale_nearest function in
pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers
to cause a denial of service (application crash) and possibly
execute arbitrary code via a crafted GIF image file, which triggers
a heap-based buffer overflow.
For Debian 7 "Wheezy", these problems have been fixed in version
2.26.1-1+deb7u4.
We recommend that you upgrade your gdk-pixbuf packages.
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
90.2%