Multiple integer overflows in the (1) pixops_composite_nearest, (2) pixops_composite_color_nearest, and (3) pixops_process functions in pixops/pixops.c in gdk-pixbuf before 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade gdk-pixbuf | May 30, 2016 | May 30, 2016 |
| Oracle Solaris | — | Upgrade library/desktop/gtk2 to version 2.20.1-0.175.3.17.0.4.0 on Solaris 11.3Upgrade image/viewer/eog to version 2.30.2-0.175.3.17.0.4.0 on Solaris 11.3Upgrade library/desktop/gtk2/gtk-backend-cups to version 2.20.1-0.175.3.17.0.4.0 on Solaris 11.3 | May 29, 2017 | Jun 1, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 6, 2015 |
| Ubuntu | — | Upgrade libgdk-pixbuf2.0-0 | Sep 21, 2016 | Jun 1, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub