{"id": "CVE-2017-1000422", "bulletinFamily": "NVD", "title": "CVE-2017-1000422", "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "published": "2018-01-02T15:29:00", "modified": "2018-03-15T21:29:03", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "reporter": "NVD", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://bugzilla.gnome.org/show_bug.cgi?id=785973", "https://lists.debian.org/debian-lts-announce/2018/01/msg00007.html", "https://usn.ubuntu.com/3532-1/"], "cvelist": ["CVE-2017-1000422"], "type": "cve", "lastseen": "2018-03-16T11:01:35", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": [], "cvelist": ["CVE-2017-1000422"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "edition": 1, "enchantments": {"score": {"modified": "2018-01-03T11:51:47", "value": 1.9}}, "hash": "ad04895054cb0a159b18336a01c3324f79509f7676d47b49905cc614db3f912d", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d7f24fca4c6dacf5e24a34d1b5253897", "key": "cvelist"}, {"hash": "f3c03da482e68b603dfa92148a0dfed3", "key": "title"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "modified"}, {"hash": "5aca07c53ef4698268cb54967de167f1", "key": "href"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5a111f535bad4fc211365d33738dcb7e", "key": "description"}, {"hash": "8cfc6779e2b197cd3dc3dabe8fd3e953", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "id": "CVE-2017-1000422", "lastseen": "2018-01-03T11:51:47", "modified": "2018-01-02T15:29:00", "objectVersion": "1.3", "published": "2018-01-02T15:29:00", "references": ["https://bugzilla.gnome.org/show_bug.cgi?id=785973"], "reporter": "NVD", "scanner": [], "title": "CVE-2017-1000422", "type": "cve", "viewCount": 2}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2018-01-03T11:51:47"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": [], "cvelist": ["CVE-2017-1000422"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "edition": 2, "enchantments": {"score": {"modified": "2018-01-17T11:29:24", "value": null}}, "hash": "4768fa66d7a486e43203cb0ae32d7892f5b075a674a39ebf6f6aa10a36304e5d", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d7f24fca4c6dacf5e24a34d1b5253897", "key": "cvelist"}, {"hash": "f3c03da482e68b603dfa92148a0dfed3", "key": "title"}, {"hash": "cebfd85bb09c2154b1ad021479ed6c93", "key": "modified"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "bf0c196156c6219b11e0358e5aff41e4", "key": "references"}, {"hash": "5aca07c53ef4698268cb54967de167f1", "key": "href"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5a111f535bad4fc211365d33738dcb7e", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "id": "CVE-2017-1000422", "lastseen": "2018-01-17T11:29:24", "modified": "2018-01-16T21:29:00", "objectVersion": "1.3", "published": "2018-01-02T15:29:00", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://bugzilla.gnome.org/show_bug.cgi?id=785973"], "reporter": "NVD", "scanner": [], "title": "CVE-2017-1000422", "type": "cve", "viewCount": 2}, "differentElements": ["cvss", "modified", "cpe"], "edition": 2, "lastseen": "2018-01-17T11:29:24"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:gnome:gdk-pixbuf:2.36.8"], "cvelist": ["CVE-2017-1000422"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "edition": 3, "enchantments": {"score": {"modified": "2018-01-18T11:29:41", "value": 1.9}}, "hash": "17e05c52e8367aaa7e4d1830daed745a8e1bf006a7e77cddeb46ec84caffba4c", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d7f24fca4c6dacf5e24a34d1b5253897", "key": "cvelist"}, {"hash": "f3c03da482e68b603dfa92148a0dfed3", "key": "title"}, {"hash": "661c5861008e3c099b635932a0880efd", "key": "cpe"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "bf0c196156c6219b11e0358e5aff41e4", "key": "references"}, {"hash": "5aca07c53ef4698268cb54967de167f1", "key": "href"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "309dd058c1f0549f428a2a6e9ef7ffc4", "key": "modified"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5a111f535bad4fc211365d33738dcb7e", "key": "description"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "id": "CVE-2017-1000422", "lastseen": "2018-01-18T11:29:41", "modified": "2018-01-17T11:14:04", "objectVersion": "1.3", "published": "2018-01-02T15:29:00", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://bugzilla.gnome.org/show_bug.cgi?id=785973"], "reporter": "NVD", "scanner": [], "title": "CVE-2017-1000422", "type": "cve", "viewCount": 2}, "differentElements": ["references", "modified"], "edition": 3, "lastseen": "2018-01-18T11:29:41"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:gnome:gdk-pixbuf:2.36.8"], "cvelist": ["CVE-2017-1000422"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "edition": 4, "enchantments": {"score": {"modified": "2018-02-05T15:16:04", "value": 1.9}}, "hash": "972d1bc58f98788d851f1f5002027beea23971b1b46cf3bc31f6ede4fe7c5ec6", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d7f24fca4c6dacf5e24a34d1b5253897", "key": "cvelist"}, {"hash": "f3c03da482e68b603dfa92148a0dfed3", "key": "title"}, {"hash": "661c5861008e3c099b635932a0880efd", "key": "cpe"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "5aca07c53ef4698268cb54967de167f1", "key": "href"}, {"hash": "791d37dd6672981774704d2742891855", "key": "references"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "1db754431f18c3cff3ff9e2e5695abd2", "key": "modified"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5a111f535bad4fc211365d33738dcb7e", "key": "description"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "id": "CVE-2017-1000422", "lastseen": "2018-02-05T15:16:04", "modified": "2018-02-03T21:29:03", "objectVersion": "1.3", "published": "2018-01-02T15:29:00", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://bugzilla.gnome.org/show_bug.cgi?id=785973", "https://lists.debian.org/debian-lts-announce/2018/01/msg00007.html"], "reporter": "NVD", "scanner": [], "title": "CVE-2017-1000422", "type": "cve", "viewCount": 2}, "differentElements": ["references", "modified"], "edition": 4, "lastseen": "2018-02-05T15:16:04"}], "edition": 5, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "661c5861008e3c099b635932a0880efd"}, {"key": "cvelist", "hash": "d7f24fca4c6dacf5e24a34d1b5253897"}, {"key": "cvss", "hash": "737e2591b537c46d1ca7ce6f0cea5cb9"}, {"key": "description", "hash": "5a111f535bad4fc211365d33738dcb7e"}, {"key": "href", "hash": "5aca07c53ef4698268cb54967de167f1"}, {"key": "modified", "hash": "dd4e3b4c23314e42f712d028769c98e7"}, {"key": "published", "hash": "6c6eab0172c7fd401555586ff22f7411"}, {"key": "references", "hash": "a7c6b6eb2bce433367c11ab0d0fb170d"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "f3c03da482e68b603dfa92148a0dfed3"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "773e2772231e85d776768ce25267508db42beb8700eb8b75f4d460a5c7b10c33", "viewCount": 3, "enchantments": {"vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:gnome:gdk-pixbuf:2.36.8"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"result": {"nessus": [{"id": "DEBIAN_DSA-4088.NASL", "type": "nessus", "title": "Debian DSA-4088-1 : gdk-pixbuf - security update", "description": "It was discovered that multiple integer overflows in the GIF image loader in the GDK Pixbuf library may result in denial of service and potentially the execution of arbitrary code if a malformed image file is opened.", "published": "2018-01-16T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=106056", "cvelist": ["CVE-2017-1000422"], "lastseen": "2018-01-30T01:00:15"}, {"id": "EULEROS_SA-2018-1046.NASL", "type": "nessus", "title": "EulerOS 2.0 SP2 : gdk-pixbuf2 (EulerOS-SA-2018-1046)", "description": "According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.(CVE-2017-2862)\n\n - An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.(CVE-2017-2870)\n\n - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution(CVE-2017-1000422)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2018-02-13T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=106774", "cvelist": ["CVE-2017-2870", "CVE-2017-2862", "CVE-2017-1000422"], "lastseen": "2018-04-21T13:52:47"}, {"id": "EULEROS_SA-2018-1045.NASL", "type": "nessus", "title": "EulerOS 2.0 SP1 : gdk-pixbuf2 (EulerOS-SA-2018-1045)", "description": "According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.(CVE-2017-2862)\n\n - An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.(CVE-2017-2870)\n\n - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution(CVE-2017-1000422)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2018-02-13T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=106773", "cvelist": ["CVE-2017-2870", "CVE-2017-2862", "CVE-2017-1000422"], "lastseen": "2018-04-21T13:57:28"}, {"id": "UBUNTU_USN-3532-1.NASL", "type": "nessus", "title": "Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : gdk-pixbuf vulnerabilities (USN-3532-1)", "description": "It was discoreved that GDK-PixBuf incorrectly handled certain gif images. An attacker could use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2017-1000422)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled certain images. An attacker could use this to cause a denial of service. (CVE-2017-6312, CVE-2017-6313)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled large TIFF files. An attacker could use this to cause a denial of service.\n(CVE-2017-6314).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2018-01-16T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=106074", "cvelist": ["CVE-2017-6312", "CVE-2017-6313", "CVE-2017-6314", "CVE-2017-1000422"], "lastseen": "2018-01-31T07:00:18"}], "gentoo": [{"id": "GLSA-201804-14", "type": "gentoo", "title": "GDK-PixBuf: Remote code execution", "description": "### Background\n\nGDK-PixBuf is an image loading library for GTK+.\n\n### Description\n\nSeveral integer overflows were discovered in GDK-PixBuf\u2019s gif_get_lzw function. \n\n### Impact\n\nA remote attacker, by enticing a user to process a specially crafted image file, could execute arbitrary code or cause a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll GDK-PixBuf users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=x11-libs/gdk-pixbuf-2.36.11\"", "published": "2018-04-17T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://security.gentoo.org/glsa/201804-14", "cvelist": ["CVE-2017-1000422"], "lastseen": "2018-04-17T23:20:45"}], "debian": [{"id": "DSA-4088", "type": "debian", "title": "gdk-pixbuf -- security update", "description": "It was discovered that multiple integer overflows in the GIF image loader in the GDK Pixbuf library may result in denial of service and potentially the execution of arbitrary code if a malformed image file is opened.\n\nFor the oldstable distribution (jessie), this problem has been fixed in version 2.31.1-2+deb8u7.\n\nFor the stable distribution (stretch), this problem has been fixed in version 2.36.5-2+deb9u2. In addition this update provides fixes for [CVE-2017-6312](<https://security-tracker.debian.org/tracker/CVE-2017-6312>), [CVE-2017-6313](<https://security-tracker.debian.org/tracker/CVE-2017-6313>) and [CVE-2017-6314](<https://security-tracker.debian.org/tracker/CVE-2017-6314>).\n\nWe recommend that you upgrade your gdk-pixbuf packages.\n\nFor the detailed security status of gdk-pixbuf please refer to its security tracker page at: <https://security-tracker.debian.org/tracker/gdk-pixbuf>", "published": "2018-01-15T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-4088", "cvelist": ["CVE-2017-1000422"], "lastseen": "2018-03-12T12:47:40"}], "openvas": [{"id": "OPENVAS:1361412562310891234", "type": "openvas", "title": "Debian LTS Advisory ([SECURITY] [DLA 1234-2] gdk-pixbuf regression update)", "description": "The patch introduced in DLA-1234-1 had a problem that caused\ngdk-pixbuf", "published": "2018-01-11T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891234", "cvelist": ["CVE-2017-1000422"], "lastseen": "2018-03-29T18:47:45"}, {"id": "OPENVAS:1361412562310704088", "type": "openvas", "title": "Debian Security Advisory DSA 4088-1 (gdk-pixbuf - security update)", "description": "It was discovered that multiple integer overflows in the GIF image loader\nin the GDK Pixbuf library may result in denial of service and potentially\nthe execution of arbitrary code if a malformed image file is opened.", "published": "2018-01-15T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704088", "cvelist": ["CVE-2017-6312", "CVE-2017-6313", "CVE-2017-6314", "CVE-2017-1000422"], "lastseen": "2018-01-23T13:03:49"}], "ubuntu": [{"id": "USN-3532-1", "type": "ubuntu", "title": "GDK-PixBuf vulnerabilities", "description": "It was discoreved that GDK-PixBuf incorrectly handled certain gif images. An attacker could use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-1000422)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled certain images. An attacker could use this to cause a denial of service. (CVE-2017-6312, CVE-2017-6313)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled large TIFF files. An attacker could use this to cause a denial of service. (CVE-2017-6314)", "published": "2018-01-15T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://usn.ubuntu.com/3532-1/", "cvelist": ["CVE-2017-6312", "CVE-2017-6313", "CVE-2017-6314", "CVE-2017-1000422"], "lastseen": "2018-03-29T18:18:48"}]}}