Debian Long Term Support / LTS Security Information / 2016 / Security Information -- DLA-450-1 gdk-pixbuf

Debian Security Advisory

DLA-450-1 gdk-pixbuf -- LTS security update

Date Reported:

30 Apr 2016

Affected Packages:

gdk-pixbuf

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2015-7552, CVE-2015-7674.

More information:

A heap-based buffer overflow has been discovered in gdk-pixbuf, a library for image loading and saving facilities, fast scaling and compositing of pixbufs, that allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.

This update also fixes an incomplete patch for CVE-2015-7674.

• CVE-2015-7552

  Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.

• CVE-2015-7674

  Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.

For Debian 7 Wheezy, these problems have been fixed in version 2.26.1-1+deb7u4.

We recommend that you upgrade your gdk-pixbuf packages.