Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2005:2] gtk+2, gdk-pixbuf: XPM decoding vulnerabilities

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <thomas.houssin AT gmail.com>
  • To: sm-security AT lists.ibiblio.org
  • Cc: lwn AT lwn.net
  • Subject: [SM-Security] [SMGLSA-2005:2] gtk+2, gdk-pixbuf: XPM decoding vulnerabilities
  • Date: Mon, 5 Dec 2005 02:15:41 +0100

Synopsis
========
The GdkPixbuf library, that is also included in GTK+ 2, contains
vulnerabilities that could lead to a Denial of Service or the execution
of arbitrary code.

Background
==========
GTK+ is a widget toolkit for X and other windowing systems. It is used
in such projects as the GIMP and GNOME.
The GdkPixbuf library provides a number of features:
- GdkPixbuf structure for representing images.
- Image loading facilities, both synchronous and progressive.
- Rendering of a GdkPixbuf into various formats.
- Fast scaling and compositing of pixbufs.
- Simple animation loading (ie. animated gifs).

Description
===========
CVE-2005-2975:
io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before
2.8.7 allows attackers to cause a denial of service (infinite loop) via
a crafted XPM image with a large number of colors.

CVE-2005-2976:
Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7
allows attackers to cause a denial of service (crash) or execute
arbitrary code via an XPM file with large height, width, and colour
values.

CVE-2005-3186
Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in
GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file
with a number of colors that causes insufficient memory to be
allocated, which leads to a heap-based buffer overflow.

Impact
======
Using a specially crafted XPM image an attacker could cause an affected
application to trigger the overflows, potentially allowing the
execution of arbitrary code.

Workaround
==========
There are no known workarounds at this time.

Affected packages
=================
This is now fixed in all grimoires.

Resolution
==========
All gtk+2 and gdk-pixbuf users should upgrade to the latest available
version:
# scribe update
# cast -c gtk+2 gdk-pixbuf

References
==========
[ 1 ] GLSA 200511-14
http://www.gentoo.org/security/en/glsa/glsa-200511-14.xml
[ 2 ] CVE-2005-2975
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2975
[ 3 ] CVE-2005-2976
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2976
[ 3 ] CVE-2005-3186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3186

--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: PGP signature



  • [SM-Security] [SMGLSA-2005:2] gtk+2, gdk-pixbuf: XPM decoding vulnerabilities, Thomas Houssin, 12/04/2005

Archive powered by MHonArc 2.6.24.

Top of Page