The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 3, 2016 |
| Debian | — | Upgrade gdk-pixbuf | Dec 23, 2019 | Oct 3, 2016 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Oct 3, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 13, 2016 |
| Suse | — | Upgrade typelib-1_0-GdkPixbuf-2_0Upgrade gdk-pixbuf-query-loaders-32bitUpgrade gtk2-docUpgrade gdk-pixbuf-query-loadersUpgrade gtk2Upgrade gtk2-develUpgrade gtk2-32bitUpgrade gdk-pixbuf-develUpgrade gtk2-x86Upgrade gtk2-devel-32bitUpgrade typelib-1_0-GdkPixdata-2_0Upgrade libgdk_pixbuf-2_0-0Upgrade libgdk_pixbuf-2_0-0-32bitUpgrade gdk-pixbuf-langUpgrade gtk2-langUpgrade gdk-pixbuf-thumbnailer | Oct 12, 2016 | Oct 3, 2016 |
| Ubuntu | — | Upgrade libgdk-pixbuf2.0-0 | Jul 1, 2017 | Sep 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub