|
GTK+ GdkPixbuf XPM Image Rendering Library Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA17522
|
|
|
Release Date:
|
2005-11-15
|
|
Last Update:
|
2005-11-16
|
|
Popularity:
|
13,045 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | GdkPixbuf 0.x
GTK+ 2.x
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
Some vulnerabilities have been reported in GTK+, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system.
1) An integer overflow error exists in "/gtk+/gdk-pixbuf/io-xpm.c" due to the insufficient validation of the "n_col" value before using it to allocate memory. This can cause a heap-based buffer overflow and may be exploited to execute arbitrary code when a specially crafted XPM file is opened in an application that is linked with the library.
This may be related to vulnerability #2 in:
SA12542
2) An error in "/gtk+/gdk-pixbuf/io-xpm.c" can cause an infinite loop when processing a XPM file with a large number of colours. This can be exploited to cause an application linked with the library to stop responding when a malicious XPM file is opened.
3) An integer overflow error exists in "/gtk+/gdk-pixbuf/io-xpm.c" when performing calculations using the height, width and colours of a XPM file. This may be exploited to execute arbitrary code or to crash an application that is linked with the library when a malicious XPM file is opened.
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
