Multiple integer overflows in the (1) pixops_composite_nearest, (2) pixops_composite_color_nearest, and (3) pixops_process functions in pixops/pixops.c in gdk-pixbuf before 2.33.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-gdk-pixbuf | May 30, 2016 | May 30, 2016 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-image-viewer-eog-2-30-2-0-175-3-17-0-4-0oracle-solaris-11-3-upgrade-library-desktop-gtk2-2-20-1-0-175-3-17-0-4-0oracle-solaris-11-3-upgrade-library-desktop-gtk2-gtk-backend-cups-2-20-1-0-175-3-17-0-4-0 | May 29, 2017 | Jun 1, 2016 | |
| Ubuntu | ubuntu-upgrade-libgdk-pixbuf2-0-0 | Sep 21, 2016 | Jun 1, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub