Denial Of Service (DoS) Through Out-of-Bounds Write

2018-07-2602:35:28

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.01 Low

EPSS

Percentile

83.4%

JSON

libgdk_pixbuf-2.0.so is vulnerable to denial of service (DoS) attacks. A malicious user can pass a ICO file to the OneLine32 function in io-ico.c, causing a out-of-bounds write that can crash the application.

CPENameOperatorVersion
libgdk_pixbuf-2.0.soeq0.2400.1

CPE	Name	Operator	Version
	libgdk_pixbuf-2.0.so	eq	0.2400.1

References

lists.opensuse.org/opensuse-updates/2016-09/msg00040.html

www.openwall.com/lists/oss-security/2016/07/13/11

www.openwall.com/lists/oss-security/2016/07/26/11

www.ubuntu.com/usn/USN-3085-1

bugzilla.gnome.org/show_bug.cgi?id=769170

build.opensuse.org/package/view_file/openSUSE:Maintenance:5576/gdk-pixbuf.openSUSE_13.2_Update/gdk-pixbuf-bgo768688-bmp-overflow.patch?rev=8c1a36a1647b4c7c8335ca49b9fd8838

git.gnome.org/browse/gdk-pixbuf/commit/?id=88af50a864195da1a4f7bda5f02539704fbda599

git.gnome.org/browse/gdk-pixbuf/tree/NEWS?id=640134c46221689d263369872937192e4484c83b

gitlab.gnome.org/GNOME/gdk-pixbuf/commit/88af50a864195da1a4f7bda5f02539704fbda599

lists.debian.org/debian-lts-announce/2019/12/msg00025.html