Security bugs are reported here via bugzilla

[Thomas Houssin <thomas.houssin AT gmail.com>]

Synopsis
========
The GdkPixbuf library, that is also included in GTK+ 2, contains
vulnerabilities that could lead to a Denial of Service or the execution
of arbitrary code.

Background
==========
GTK+ is a widget toolkit for X and other windowing systems. It is used
in such projects as the GIMP and GNOME.
The GdkPixbuf library provides a number of features:
 - GdkPixbuf structure for representing images.
 - Image loading facilities, both synchronous and progressive.
 - Rendering of a GdkPixbuf into various formats.
 - Fast scaling and compositing of pixbufs.
 - Simple animation loading (ie. animated gifs).

Description
===========
CVE-2005-2975:
io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before
2.8.7 allows attackers to cause a denial of service (infinite loop) via
a crafted XPM image with a large number of colors.

CVE-2005-2976:
Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7
allows attackers to cause a denial of service (crash) or execute
arbitrary code via an XPM file with large height, width, and colour
values.

CVE-2005-3186
Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in
GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file
with a number of colors that causes insufficient memory to be
allocated, which leads to a heap-based buffer overflow. 

Impact
======
Using a specially crafted XPM image an attacker could cause an affected
application to trigger the overflows, potentially allowing the
execution of arbitrary code. 

Workaround
========== 
There are no known workarounds at this time.

Affected packages
=================
This is now fixed in all grimoires.

Resolution
==========
All gtk+2 and gdk-pixbuf users should upgrade to the latest available
version: 
        # scribe update
        # cast -c gtk+2 gdk-pixbuf

References
==========
  [ 1 ] GLSA 200511-14
        http://www.gentoo.org/security/en/glsa/glsa-200511-14.xml
  [ 2 ] CVE-2005-2975
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2975
  [ 3 ] CVE-2005-2976
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2976
  [ 3 ] CVE-2005-3186
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3186

-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: PGP signature