Debian Security Advisory
DLA-450-1 gdk-pixbuf -- LTS security update
- Date Reported:
- 30 Apr 2016
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2015-7552, CVE-2015-7674.
- More information:
A heap-based buffer overflow has been discovered in gdk-pixbuf, a library for image loading and saving facilities, fast scaling and compositing of pixbufs, that allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
This update also fixes an incomplete patch for CVE-2015-7674.
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.
For Debian 7
Wheezy, these problems have been fixed in version 2.26.1-1+deb7u4.
We recommend that you upgrade your gdk-pixbuf packages.