{"id": "CVE-2017-1000422", "bulletinFamily": "NVD", "title": "CVE-2017-1000422", "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "published": "2018-01-02T15:29:00", "modified": "2018-10-21T06:29:04", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "reporter": "NVD", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://security.gentoo.org/glsa/201804-14", "https://bugzilla.gnome.org/show_bug.cgi?id=785973", "https://lists.debian.org/debian-lts-announce/2018/01/msg00007.html", "https://usn.ubuntu.com/3532-1/"], "cvelist": ["CVE-2017-1000422"], "type": "cve", "lastseen": "2018-10-22T11:12:01", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:gnome:gdk-pixbuf:2.36.8"], "cvelist": ["CVE-2017-1000422"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "edition": 5, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "hash": "773e2772231e85d776768ce25267508db42beb8700eb8b75f4d460a5c7b10c33", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "dd4e3b4c23314e42f712d028769c98e7", "key": "modified"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d7f24fca4c6dacf5e24a34d1b5253897", "key": "cvelist"}, {"hash": "a7c6b6eb2bce433367c11ab0d0fb170d", "key": "references"}, {"hash": "f3c03da482e68b603dfa92148a0dfed3", "key": "title"}, {"hash": "661c5861008e3c099b635932a0880efd", "key": "cpe"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "5aca07c53ef4698268cb54967de167f1", "key": "href"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5a111f535bad4fc211365d33738dcb7e", "key": "description"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "id": "CVE-2017-1000422", "lastseen": "2018-03-16T11:01:35", "modified": "2018-03-15T21:29:03", "objectVersion": "1.3", "published": "2018-01-02T15:29:00", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://bugzilla.gnome.org/show_bug.cgi?id=785973", "https://lists.debian.org/debian-lts-announce/2018/01/msg00007.html", "https://usn.ubuntu.com/3532-1/"], "reporter": "NVD", "scanner": [], "title": "CVE-2017-1000422", "type": "cve", "viewCount": 18}, "differentElements": ["references", "modified"], "edition": 5, "lastseen": "2018-03-16T11:01:35"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": [], "cvelist": ["CVE-2017-1000422"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "edition": 1, "enchantments": {"score": {"modified": "2018-01-03T11:51:47", "value": 1.9}}, "hash": "ad04895054cb0a159b18336a01c3324f79509f7676d47b49905cc614db3f912d", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d7f24fca4c6dacf5e24a34d1b5253897", "key": "cvelist"}, {"hash": "f3c03da482e68b603dfa92148a0dfed3", "key": "title"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "modified"}, {"hash": "5aca07c53ef4698268cb54967de167f1", "key": "href"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5a111f535bad4fc211365d33738dcb7e", "key": "description"}, {"hash": "8cfc6779e2b197cd3dc3dabe8fd3e953", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "id": "CVE-2017-1000422", "lastseen": "2018-01-03T11:51:47", "modified": "2018-01-02T15:29:00", "objectVersion": "1.3", "published": "2018-01-02T15:29:00", "references": ["https://bugzilla.gnome.org/show_bug.cgi?id=785973"], "reporter": "NVD", "scanner": [], "title": "CVE-2017-1000422", "type": "cve", "viewCount": 2}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2018-01-03T11:51:47"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": [], "cvelist": ["CVE-2017-1000422"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "edition": 2, "enchantments": {"score": {"modified": "2018-01-17T11:29:24", "value": null}}, "hash": "4768fa66d7a486e43203cb0ae32d7892f5b075a674a39ebf6f6aa10a36304e5d", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d7f24fca4c6dacf5e24a34d1b5253897", "key": "cvelist"}, {"hash": "f3c03da482e68b603dfa92148a0dfed3", "key": "title"}, {"hash": "cebfd85bb09c2154b1ad021479ed6c93", "key": "modified"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "bf0c196156c6219b11e0358e5aff41e4", "key": "references"}, {"hash": "5aca07c53ef4698268cb54967de167f1", "key": "href"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5a111f535bad4fc211365d33738dcb7e", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "id": "CVE-2017-1000422", "lastseen": "2018-01-17T11:29:24", "modified": "2018-01-16T21:29:00", "objectVersion": "1.3", "published": "2018-01-02T15:29:00", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://bugzilla.gnome.org/show_bug.cgi?id=785973"], "reporter": "NVD", "scanner": [], "title": "CVE-2017-1000422", "type": "cve", "viewCount": 2}, "differentElements": ["cvss", "modified", "cpe"], "edition": 2, "lastseen": "2018-01-17T11:29:24"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:gnome:gdk-pixbuf:2.36.8"], "cvelist": ["CVE-2017-1000422"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "edition": 3, "enchantments": {"score": {"modified": "2018-01-18T11:29:41", "value": 1.9}}, "hash": "17e05c52e8367aaa7e4d1830daed745a8e1bf006a7e77cddeb46ec84caffba4c", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d7f24fca4c6dacf5e24a34d1b5253897", "key": "cvelist"}, {"hash": "f3c03da482e68b603dfa92148a0dfed3", "key": "title"}, {"hash": "661c5861008e3c099b635932a0880efd", "key": "cpe"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "bf0c196156c6219b11e0358e5aff41e4", "key": "references"}, {"hash": "5aca07c53ef4698268cb54967de167f1", "key": "href"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "309dd058c1f0549f428a2a6e9ef7ffc4", "key": "modified"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5a111f535bad4fc211365d33738dcb7e", "key": "description"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "id": "CVE-2017-1000422", "lastseen": "2018-01-18T11:29:41", "modified": "2018-01-17T11:14:04", "objectVersion": "1.3", "published": "2018-01-02T15:29:00", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://bugzilla.gnome.org/show_bug.cgi?id=785973"], "reporter": "NVD", "scanner": [], "title": "CVE-2017-1000422", "type": "cve", "viewCount": 2}, "differentElements": ["references", "modified"], "edition": 3, "lastseen": "2018-01-18T11:29:41"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:gnome:gdk-pixbuf:2.36.8"], "cvelist": ["CVE-2017-1000422"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution", "edition": 4, "enchantments": {"score": {"modified": "2018-02-05T15:16:04", "value": 1.9}}, "hash": "972d1bc58f98788d851f1f5002027beea23971b1b46cf3bc31f6ede4fe7c5ec6", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d7f24fca4c6dacf5e24a34d1b5253897", "key": "cvelist"}, {"hash": "f3c03da482e68b603dfa92148a0dfed3", "key": "title"}, {"hash": "661c5861008e3c099b635932a0880efd", "key": "cpe"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "5aca07c53ef4698268cb54967de167f1", "key": "href"}, {"hash": "791d37dd6672981774704d2742891855", "key": "references"}, {"hash": "6c6eab0172c7fd401555586ff22f7411", "key": "published"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "1db754431f18c3cff3ff9e2e5695abd2", "key": "modified"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "5a111f535bad4fc211365d33738dcb7e", "key": "description"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000422", "id": "CVE-2017-1000422", "lastseen": "2018-02-05T15:16:04", "modified": "2018-02-03T21:29:03", "objectVersion": "1.3", "published": "2018-01-02T15:29:00", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://bugzilla.gnome.org/show_bug.cgi?id=785973", "https://lists.debian.org/debian-lts-announce/2018/01/msg00007.html"], "reporter": "NVD", "scanner": [], "title": "CVE-2017-1000422", "type": "cve", "viewCount": 2}, "differentElements": ["references", "modified"], "edition": 4, "lastseen": "2018-02-05T15:16:04"}], "edition": 6, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "661c5861008e3c099b635932a0880efd"}, {"key": "cvelist", "hash": "d7f24fca4c6dacf5e24a34d1b5253897"}, {"key": "cvss", "hash": "737e2591b537c46d1ca7ce6f0cea5cb9"}, {"key": "description", "hash": "5a111f535bad4fc211365d33738dcb7e"}, {"key": "href", "hash": "5aca07c53ef4698268cb54967de167f1"}, {"key": "modified", "hash": "14878bee912bd9d027a12b55f2f5243e"}, {"key": "published", "hash": "6c6eab0172c7fd401555586ff22f7411"}, {"key": "references", "hash": "e591a262bd6d46d54fd2852b6bfdc501"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "f3c03da482e68b603dfa92148a0dfed3"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "3dabb25df8edea6b1b44d1d2cfc9916f7472af28e7ca9386063b615fbaad9877", "viewCount": 28, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:gnome:gdk-pixbuf:2.36.8"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"openvas": [{"lastseen": "2018-11-23T15:03:33", "references": ["2018:2013_1", "http://lists.opensuse.org/opensuse-security-announce/2018-07/msg00025.html"], "pluginID": "1361412562310851817", "description": "The remote host is missing an update for the ", "edition": 7, "reporter": "Copyright (C) 2018 Greenbone Networks GmbH", "published": "2018-07-20T00:00:00", "title": "SuSE Update for gdk-pixbuf openSUSE-SU-2018:2013-1 (gdk-pixbuf)", "type": "openvas", "enchantments": {"score": {"modified": "2018-11-23T15:03:33", "vector": "NONE", "value": 7.5}}, "naslFamily": "SuSE Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000422"], "modified": "2018-11-23T00:00:00", "id": "OPENVAS:1361412562310851817", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851817", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2018_2013_1.nasl 12497 2018-11-23 08:28:21Z cfischer $\n#\n# SuSE Update for gdk-pixbuf openSUSE-SU-2018:2013-1 (gdk-pixbuf)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851817\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2018-07-20 05:54:39 +0200 (Fri, 20 Jul 2018)\");\n script_cve_id(\"CVE-2017-1000422\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SuSE Update for gdk-pixbuf openSUSE-SU-2018:2013-1 (gdk-pixbuf)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'gdk-pixbuf'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"This update for gdk-pixbuf fixes the following security issue:\n\n - CVE-2017-1000422: Prevent several integer overflow in the gif_get_lzw\n function resulting in memory corruption and potential code execution\n (bsc#1074462).\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\n\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 42.3:\n\n zypper in -t patch openSUSE-2018-741=1\");\n script_tag(name:\"affected\", value:\"gdk-pixbuf on openSUSE Leap 42.3\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:2013_1\");\n script_xref(name:\"URL\", value:\"http://lists.opensuse.org/opensuse-security-announce/2018-07/msg00025.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.3\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\nres = \"\";\n\nif(release == \"openSUSELeap42.3\")\n{\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-debugsource\", rpm:\"gdk-pixbuf-debugsource~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-devel\", rpm:\"gdk-pixbuf-devel~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-devel-debuginfo\", rpm:\"gdk-pixbuf-devel-debuginfo~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-query-loaders\", rpm:\"gdk-pixbuf-query-loaders~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-query-loaders-debuginfo\", rpm:\"gdk-pixbuf-query-loaders-debuginfo~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libgdk_pixbuf-2_0-0\", rpm:\"libgdk_pixbuf-2_0-0~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libgdk_pixbuf-2_0-0-debuginfo\", rpm:\"libgdk_pixbuf-2_0-0-debuginfo~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"typelib-1_0-GdkPixbuf-2_0\", rpm:\"typelib-1_0-GdkPixbuf-2_0~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-lang\", rpm:\"gdk-pixbuf-lang~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-devel-32bit\", rpm:\"gdk-pixbuf-devel-32bit~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-devel-debuginfo-32bit\", rpm:\"gdk-pixbuf-devel-debuginfo-32bit~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-query-loaders-32bit\", rpm:\"gdk-pixbuf-query-loaders-32bit~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"gdk-pixbuf-query-loaders-debuginfo-32bit\", rpm:\"gdk-pixbuf-query-loaders-debuginfo-32bit~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libgdk_pixbuf-2_0-0-32bit\", rpm:\"libgdk_pixbuf-2_0-0-32bit~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libgdk_pixbuf-2_0-0-debuginfo-32bit\", rpm:\"libgdk_pixbuf-2_0-0-debuginfo-32bit~2.34.0~16.1\", rls:\"openSUSELeap42.3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:39:48", "references": ["https://lists.debian.org/debian-lts-announce/2018/01/msg00009.html"], "pluginID": "1361412562310891234", "description": "The patch introduced in DLA-1234-1 had a problem that caused\ngdk-pixbuf", "edition": 6, "reporter": "Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net", "published": "2018-01-11T00:00:00", "title": "Debian LTS Advisory ([SECURITY] [DLA 1234-2] gdk-pixbuf regression update)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000422"], "modified": "2018-06-15T00:00:00", "id": "OPENVAS:1361412562310891234", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891234", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: deb_dla_1234.nasl 10219 2018-06-15 12:00:55Z cfischer $\n#\n# Auto-generated from advisory DLA 1234-2 using nvtgen 1.0\n# Script version:2.0\n# #\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891234\");\n script_version(\"$Revision: 10219 $\");\n script_cve_id(\"CVE-2017-1000422\");\n script_name(\"Debian LTS Advisory ([SECURITY] [DLA 1234-2] gdk-pixbuf regression update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-06-15 14:00:55 +0200 (Fri, 15 Jun 2018) $\");\n script_tag(name:\"creation_date\", value:\"2018-01-11 00:00:00 +0100 (Thu, 11 Jan 2018)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2018/01/msg00009.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\\.[0-9]+\");\n script_tag(name:\"affected\", value:\"gdk-pixbuf on Debian Linux\");\n script_tag(name:\"solution\", value:\"For Debian 7 'Wheezy', these problems have been fixed in version\n2.26.1-1+deb7u8.\n\nWe recommend that you upgrade your gdk-pixbuf packages.\");\n script_tag(name:\"summary\", value:\"The patch introduced in DLA-1234-1 had a problem that caused\ngdk-pixbuf's gif module to fail to load.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"gir1.2-gdkpixbuf-2.0\", ver:\"2.26.1-1+deb7u8\", rls_regex:\"DEB7\\.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-0\", ver:\"2.26.1-1+deb7u8\", rls_regex:\"DEB7\\.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-common\", ver:\"2.26.1-1+deb7u8\", rls_regex:\"DEB7\\.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-dev\", ver:\"2.26.1-1+deb7u8\", rls_regex:\"DEB7\\.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-doc\", ver:\"2.26.1-1+deb7u8\", rls_regex:\"DEB7\\.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-10-29T12:33:53", "references": ["http://www.ubuntu.com/usn/usn-3532-1/", "3532-1"], "pluginID": "1361412562310843750", "description": "The remote host is missing an update for the ", "edition": 2, "reporter": "Copyright (C) 2018 Greenbone Networks GmbH", "published": "2018-10-26T00:00:00", "title": "Ubuntu Update for gdk-pixbuf USN-3532-1", "type": "openvas", "enchantments": {"score": {"modified": "2018-10-29T12:33:53", "vector": "NONE", "value": 7.5}}, "naslFamily": "Ubuntu Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-6312", "CVE-2017-6313", "CVE-2017-6314", "CVE-2017-1000422"], "modified": "2018-10-26T00:00:00", "id": "OPENVAS:1361412562310843750", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843750", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3532_1.nasl 12130 2018-10-26 13:59:17Z cfischer $\n#\n# Ubuntu Update for gdk-pixbuf USN-3532-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843750\");\n script_version(\"$Revision: 12130 $\");\n script_cve_id(\"CVE-2017-1000422\", \"CVE-2017-6312\", \"CVE-2017-6313\", \"CVE-2017-6314\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-26 15:59:17 +0200 (Fri, 26 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2018-10-26 06:15:00 +0200 (Fri, 26 Oct 2018)\");\n script_name(\"Ubuntu Update for gdk-pixbuf USN-3532-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(14\\.04 LTS|17\\.10|16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"3532-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3532-1/\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'gdk-pixbuf'\n package(s) announced via the USN-3532-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was discoreved that GDK-PixBuf incorrectly handled certain gif\nimages. An attacker could use this to execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2017-1000422)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled certain\nimages. An attacker could use this to cause a denial of service.\n(CVE-2017-6312, CVE-2017-6313)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled large\nTIFF files. An attacker could use this to cause a denial of service.\n(CVE-2017-6314)\");\n\n script_tag(name:\"affected\", value:\"gdk-pixbuf on Ubuntu 17.10,\n Ubuntu 16.04 LTS,\n Ubuntu 14.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-0\", ver:\"2.30.7-0ubuntu1.8\", rls:\"UBUNTU14.04 LTS\", remove_arch:TRUE)) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU17.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-0\", ver:\"2.36.11-1ubuntu0.1\", rls:\"UBUNTU17.10\", remove_arch:TRUE)) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-0\", ver:\"2.32.2-1ubuntu1.4\", rls:\"UBUNTU16.04 LTS\", remove_arch:TRUE)) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:39:55", "references": ["https://www.debian.org/security/2018/dsa-4088.html"], "pluginID": "1361412562310704088", "description": "It was discovered that multiple integer overflows in the GIF image loader\nin the GDK Pixbuf library may result in denial of service and potentially\nthe execution of arbitrary code if a malformed image file is opened.", "edition": 5, "reporter": "Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net", "published": "2018-01-15T00:00:00", "title": "Debian Security Advisory DSA 4088-1 (gdk-pixbuf - security update)", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-6312", "CVE-2017-6313", "CVE-2017-6314", "CVE-2017-1000422"], "modified": "2018-01-23T00:00:00", "id": "OPENVAS:1361412562310704088", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704088", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: deb_4088.nasl 8493 2018-01-23 06:43:13Z ckuersteiner $\n#\n# Auto-generated from advisory DSA 4088-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704088\");\n script_version(\"$Revision: 8493 $\");\n script_cve_id(\"CVE-2017-1000422\", \"CVE-2017-6312\", \"CVE-2017-6313\", \"CVE-2017-6314\");\n script_name(\"Debian Security Advisory DSA 4088-1 (gdk-pixbuf - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-23 07:43:13 +0100 (Tue, 23 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2018-01-15 00:00:00 +0100 (Mon, 15 Jan 2018)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2018/dsa-4088.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name:\"affected\", value:\"gdk-pixbuf on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (jessie), this problem has been fixed\nin version 2.31.1-2+deb8u7.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 2.36.5-2+deb9u2. In addition this update provides fixes for\nCVE-2017-6312, CVE-2017-6313 and CVE-2017-6314 \n.\n\nWe recommend that you upgrade your gdk-pixbuf packages.\n\nFor the detailed security status of gdk-pixbuf please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/gdk-pixbuf\");\n script_tag(name:\"summary\", value:\"It was discovered that multiple integer overflows in the GIF image loader\nin the GDK Pixbuf library may result in denial of service and potentially\nthe execution of arbitrary code if a malformed image file is opened.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"gir1.2-gdkpixbuf-2.0\", ver:\"2.36.5-2+deb9u2\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-0\", ver:\"2.36.5-2+deb9u2\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-common\", ver:\"2.36.5-2+deb9u2\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-dev\", ver:\"2.36.5-2+deb9u2\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-doc\", ver:\"2.36.5-2+deb9u2\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gir1.2-gdkpixbuf-2.0\", ver:\"2.31.1-2+deb8u7\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-0\", ver:\"2.31.1-2+deb8u7\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-0-dbg\", ver:\"2.31.1-2+deb8u7\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-common\", ver:\"2.31.1-2+deb8u7\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-dev\", ver:\"2.31.1-2+deb8u7\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgdk-pixbuf2.0-doc\", ver:\"2.31.1-2+deb8u7\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "gentoo": [{"lastseen": "2018-04-17T23:20:45", "references": ["https://nvd.nist.gov/vuln/detail/CVE-2017-1000422", "https://bugs.gentoo.org/show_bug.cgi?id=644770"], "affectedPackage": [{"OS": "Gentoo", "OSVersion": "any", "packageVersion": "2.36.11", "arch": "all", "packageFilename": "UNKNOWN", "packageName": "x11-libs/gdk-pixbuf", "operator": "lt"}], "description": "### Background\n\nGDK-PixBuf is an image loading library for GTK+.\n\n### Description\n\nSeveral integer overflows were discovered in GDK-PixBuf\u2019s gif_get_lzw function. \n\n### Impact\n\nA remote attacker, by enticing a user to process a specially crafted image file, could execute arbitrary code or cause a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll GDK-PixBuf users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=x11-libs/gdk-pixbuf-2.36.11\"", "edition": 1, "reporter": "Gentoo Foundation", "published": "2018-04-17T00:00:00", "type": "gentoo", "title": "GDK-PixBuf: Remote code execution", "enchantments": {"score": {"vector": "NONE", "value": 9.3}}, "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000422"], "modified": "2018-04-17T00:00:00", "href": "https://security.gentoo.org/glsa/201804-14", "id": "GLSA-201804-14", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "debian": [{"lastseen": "2018-10-18T13:48:36", "references": [], "affectedPackage": [{"OS": "Debian", "OSVersion": "7", "packageVersion": "2.26.1-1+deb7u7", "arch": "all", "packageFilename": "gdk-pixbuf_2.26.1-1+deb7u7_all.deb", "packageName": "gdk-pixbuf", "operator": "lt"}], "description": "Package : gdk-pixbuf\nVersion : 2.26.1-1+deb7u7\nCVE ID : CVE-2017-1000422\n\nIt was discovered that there were several integer overflows in\ngdk-pixbuf, a library to manipulate images for the GTK graphics toolkit.\nThis could have led to memory corruption and potential code execution.\n\nFor Debian 7 &quot;Wheezy&quot;, this issue has been fixed in gdk-pixbuf version\n2.26.1-1+deb7u7.\n\nWe recommend that you upgrade your gdk-pixbuf packages.\n\n\nRegards,\n\n- -- \n ,&#x27;&#x27;`.\n : :&#x27; : Chris Lamb\n `. `&#x27;` lamby@debian.org / chris-lamb.co.uk\n `-\n\n", "edition": 2, "reporter": "Debian", "published": "2018-01-08T14:56:00", "title": "[SECURITY] [DLA 1234-1] gdk-pixbuf security update", "type": "debian", "enchantments": {"score": {"modified": "2018-10-18T13:48:36", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000422"], "modified": "2018-01-08T14:56:00", "id": "DEBIAN:DLA-1234-1:899E8", "href": "https://lists.debian.org/debian-lts-announce/2018/debian-lts-announce-201801/msg00007.html", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-10-16T22:13:01", "references": [], "affectedPackage": [{"OS": "Debian", "OSVersion": "9", "packageVersion": "2.36.5-2+deb9u2", "arch": "all", "packageFilename": "gdk-pixbuf_2.36.5-2+deb9u2_all.deb", "packageName": "gdk-pixbuf", "operator": "lt"}, {"OS": "Debian", "OSVersion": "8", "packageVersion": "2.31.1-2+deb8u7", "arch": "all", "packageFilename": "gdk-pixbuf_2.31.1-2+deb8u7_all.deb", "packageName": "gdk-pixbuf", "operator": "lt"}, {"OS": "Debian", "OSVersion": "8", "packageVersion": "2.31.1-2+deb8u7", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-doc_2.31.1-2+deb8u7_all.deb", "packageName": "libgdk-pixbuf2.0-doc", "operator": "lt"}, {"OS": "Debian", "OSVersion": "8", "packageVersion": "2.31.1-2+deb8u7", "arch": "all", "packageFilename": "gir1.2-gdkpixbuf-2.0_2.31.1-2+deb8u7_all.deb", "packageName": "gir1.2-gdkpixbuf-2.0", "operator": "lt"}, {"OS": "Debian", "OSVersion": "9", "packageVersion": "2.36.5-2+deb9u2", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-common_2.36.5-2+deb9u2_all.deb", "packageName": "libgdk-pixbuf2.0-common", "operator": "lt"}, {"OS": "Debian", "OSVersion": "8", "packageVersion": "2.31.1-2+deb8u7", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-common_2.31.1-2+deb8u7_all.deb", "packageName": "libgdk-pixbuf2.0-common", "operator": "lt"}, {"OS": "Debian", "OSVersion": "9", "packageVersion": "2.36.5-2+deb9u2", "arch": "all", "packageFilename": "gir1.2-gdkpixbuf-2.0_2.36.5-2+deb9u2_all.deb", "packageName": "gir1.2-gdkpixbuf-2.0", "operator": "lt"}, {"OS": "Debian", "OSVersion": "8", "packageVersion": "2.31.1-2+deb8u7", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-0-dbg_2.31.1-2+deb8u7_all.deb", "packageName": "libgdk-pixbuf2.0-0-dbg", "operator": "lt"}, {"OS": "Debian", "OSVersion": "9", "packageVersion": "2.36.5-2+deb9u2", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-dev_2.36.5-2+deb9u2_all.deb", "packageName": "libgdk-pixbuf2.0-dev", "operator": "lt"}, {"OS": "Debian", "OSVersion": "8", "packageVersion": "2.31.1-2+deb8u7", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-0_2.31.1-2+deb8u7_all.deb", "packageName": "libgdk-pixbuf2.0-0", "operator": "lt"}, {"OS": "Debian", "OSVersion": "9", "packageVersion": "2.36.5-2+deb9u2", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-0-udeb_2.36.5-2+deb9u2_all.deb", "packageName": "libgdk-pixbuf2.0-0-udeb", "operator": "lt"}, {"OS": "Debian", "OSVersion": "9", "packageVersion": "2.36.5-2+deb9u2", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-doc_2.36.5-2+deb9u2_all.deb", "packageName": "libgdk-pixbuf2.0-doc", "operator": "lt"}, {"OS": "Debian", "OSVersion": "8", "packageVersion": "2.31.1-2+deb8u7", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-dev_2.31.1-2+deb8u7_all.deb", "packageName": "libgdk-pixbuf2.0-dev", "operator": "lt"}, {"OS": "Debian", "OSVersion": "8", "packageVersion": "2.31.1-2+deb8u7", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-0-udeb_2.31.1-2+deb8u7_all.deb", "packageName": "libgdk-pixbuf2.0-0-udeb", "operator": "lt"}, {"OS": "Debian", "OSVersion": "9", "packageVersion": "2.36.5-2+deb9u2", "arch": "all", "packageFilename": "libgdk-pixbuf2.0-0_2.36.5-2+deb9u2_all.deb", "packageName": "libgdk-pixbuf2.0-0", "operator": "lt"}], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4088-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nJanuary 15, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : gdk-pixbuf\nCVE ID : CVE-2017-1000422\n\nIt was discovered that multiple integer overflows in the GIF image loader\nin the GDK Pixbuf library may result in denial of service and potentially\nthe execution of arbitrary code if a malformed image file is opened.\n\nFor the oldstable distribution (jessie), this problem has been fixed\nin version 2.31.1-2+deb8u7.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 2.36.5-2+deb9u2. In addition this update provides fixes for\nCVE-2017-6312, CVE-2017-6313 and CVE-2017-6314.\n\nWe recommend that you upgrade your gdk-pixbuf packages.\n\nFor the detailed security status of gdk-pixbuf please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/gdk-pixbuf\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 1, "reporter": "Debian", "published": "2018-01-15T20:00:17", "title": "[SECURITY] [DSA 4088-1] gdk-pixbuf security update", "type": "debian", "enchantments": {"score": {"modified": "2018-10-16T22:13:01", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2017-6312", "CVE-2017-6313", "CVE-2017-6314", "CVE-2017-1000422"], "modified": "2018-01-15T20:00:17", "id": "DEBIAN:DSA-4088-1:BE67E", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2018/msg00010.html", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2018-11-14T02:52:50", "references": ["https://www.debian.org/security/2018/dsa-4088", "https://security-tracker.debian.org/tracker/CVE-2017-6314", "https://packages.debian.org/source/stretch/gdk-pixbuf", "https://security-tracker.debian.org/tracker/CVE-2017-6313", "https://packages.debian.org/source/jessie/gdk-pixbuf", "https://security-tracker.debian.org/tracker/source-package/gdk-pixbuf", "https://security-tracker.debian.org/tracker/CVE-2017-6312"], "pluginID": "106056", "description": "It was discovered that multiple integer overflows in the GIF image loader in the GDK Pixbuf library may result in denial of service and potentially the execution of arbitrary code if a malformed image file is opened.", "edition": 8, "reporter": "Tenable", "published": "2018-01-16T00:00:00", "title": "Debian DSA-4088-1 : gdk-pixbuf - security update", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000422"], "modified": "2018-11-13T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:gdk-pixbuf", "cpe:/o:debian:debian_linux:8.0", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DSA-4088.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=106056", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4088. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106056);\n script_version(\"3.5\");\n script_cvs_date(\"Date: 2018/11/13 12:30:46\");\n\n script_cve_id(\"CVE-2017-1000422\");\n script_xref(name:\"DSA\", value:\"4088\");\n\n script_name(english:\"Debian DSA-4088-1 : gdk-pixbuf - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that multiple integer overflows in the GIF image\nloader in the GDK Pixbuf library may result in denial of service and\npotentially the execution of arbitrary code if a malformed image file\nis opened.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-6312\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-6313\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-6314\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/gdk-pixbuf\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/gdk-pixbuf\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/gdk-pixbuf\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2018/dsa-4088\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the gdk-pixbuf packages.\n\nFor the oldstable distribution (jessie), this problem has been fixed\nin version 2.31.1-2+deb8u7.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 2.36.5-2+deb9u2. In addition this update provides fixes for\nCVE-2017-6312, CVE-2017-6313 and CVE-2017-6314.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:gdk-pixbuf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"gir1.2-gdkpixbuf-2.0\", reference:\"2.31.1-2+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libgdk-pixbuf2.0-0\", reference:\"2.31.1-2+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libgdk-pixbuf2.0-0-dbg\", reference:\"2.31.1-2+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libgdk-pixbuf2.0-common\", reference:\"2.31.1-2+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libgdk-pixbuf2.0-dev\", reference:\"2.31.1-2+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libgdk-pixbuf2.0-doc\", reference:\"2.31.1-2+deb8u7\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"gir1.2-gdkpixbuf-2.0\", reference:\"2.36.5-2+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libgdk-pixbuf2.0-0\", reference:\"2.36.5-2+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libgdk-pixbuf2.0-0-udeb\", reference:\"2.36.5-2+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libgdk-pixbuf2.0-common\", reference:\"2.36.5-2+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libgdk-pixbuf2.0-dev\", reference:\"2.36.5-2+deb9u2\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libgdk-pixbuf2.0-doc\", reference:\"2.36.5-2+deb9u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-02T00:00:07", "references": ["https://security.gentoo.org/glsa/201804-14"], "pluginID": "109098", "description": "The remote host is affected by the vulnerability described in GLSA-201804-14 (GDK-PixBuf: Remote code execution)\n\n Several integer overflows were discovered in GDK-PixBuf&rsquo;s gif_get_lzw function.\n Impact :\n\n A remote attacker, by enticing a user to process a specially crafted image file, could execute arbitrary code or cause a Denial of Service condition.\n Workaround :\n\n There is no known workaround at this time.", "edition": 4, "reporter": "Tenable", "published": "2018-04-18T00:00:00", "title": "GLSA-201804-14 : GDK-PixBuf: Remote code execution", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 9.3}}, "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000422"], "modified": "2018-06-07T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:gdk-pixbuf"], "id": "GENTOO_GLSA-201804-14.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=109098", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201804-14.\n#\n# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109098);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2018/06/07 13:15:38\");\n\n script_cve_id(\"CVE-2017-1000422\");\n script_xref(name:\"GLSA\", value:\"201804-14\");\n\n script_name(english:\"GLSA-201804-14 : GDK-PixBuf: Remote code execution\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201804-14\n(GDK-PixBuf: Remote code execution)\n\n Several integer overflows were discovered in GDK-PixBuf&rsquo;s gif_get_lzw\n function.\n \nImpact :\n\n A remote attacker, by enticing a user to process a specially crafted\n image file, could execute arbitrary code or cause a Denial of Service\n condition.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201804-14\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All GDK-PixBuf users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=x11-libs/gdk-pixbuf-2.36.11'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:gdk-pixbuf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/04/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/04/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"x11-libs/gdk-pixbuf\", unaffected:make_list(\"ge 2.36.11\"), vulnerable:make_list(\"lt 2.36.11\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"GDK-PixBuf\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-02T00:01:47", "references": ["https://bugzilla.opensuse.org/show_bug.cgi?id=1074462"], "pluginID": "111196", "description": "This update for gdk-pixbuf fixes the following security issue :\n\n - CVE-2017-1000422: Prevent several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution (bsc#1074462).\n\nThis update was imported from the SUSE:SLE-12-SP2:Update update project.", "edition": 3, "reporter": "Tenable", "published": "2018-07-20T00:00:00", "title": "openSUSE Security Update : gdk-pixbuf (openSUSE-2018-741)", "type": "nessus", "enchantments": {"score": {"modified": "2018-09-02T00:01:47", "vector": "NONE", "value": 7.5}}, "naslFamily": "SuSE Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000422"], "modified": "2018-07-20T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libgdk_pixbuf-2_0-0-debuginfo", "p-cpe:/a:novell:opensuse:gdk-pixbuf-debugsource", "p-cpe:/a:novell:opensuse:gdk-pixbuf-query-loaders", "p-cpe:/a:novell:opensuse:libgdk_pixbuf-2_0-0-debuginfo-32bit", "p-cpe:/a:novell:opensuse:gdk-pixbuf-query-loaders-32bit", "p-cpe:/a:novell:opensuse:gdk-pixbuf-devel-debuginfo-32bit", "p-cpe:/a:novell:opensuse:gdk-pixbuf-query-loaders-debuginfo-32bit", "p-cpe:/a:novell:opensuse:gdk-pixbuf-devel-32bit", "p-cpe:/a:novell:opensuse:gdk-pixbuf-devel", "p-cpe:/a:novell:opensuse:typelib-1_0-GdkPixbuf-2_0", "p-cpe:/a:novell:opensuse:gdk-pixbuf-lang", "p-cpe:/a:novell:opensuse:libgdk_pixbuf-2_0-0", "p-cpe:/a:novell:opensuse:gdk-pixbuf-devel-debuginfo", "cpe:/o:novell:opensuse:42.3", "p-cpe:/a:novell:opensuse:gdk-pixbuf-query-loaders-debuginfo", "p-cpe:/a:novell:opensuse:libgdk_pixbuf-2_0-0-32bit"], "id": "OPENSUSE-2018-741.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=111196", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2018-741.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(111196);\n script_version(\"1.1\");\n script_cvs_date(\"Date: 2018/07/20 18:27:24\");\n\n script_cve_id(\"CVE-2017-1000422\");\n\n script_name(english:\"openSUSE Security Update : gdk-pixbuf (openSUSE-2018-741)\");\n script_summary(english:\"Check for the openSUSE-2018-741 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for gdk-pixbuf fixes the following security issue :\n\n - CVE-2017-1000422: Prevent several integer overflow in\n the gif_get_lzw function resulting in memory corruption\n and potential code execution (bsc#1074462).\n\nThis update was imported from the SUSE:SLE-12-SP2:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1074462\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected gdk-pixbuf packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-devel-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-devel-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-query-loaders\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-query-loaders-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-query-loaders-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gdk-pixbuf-query-loaders-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgdk_pixbuf-2_0-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgdk_pixbuf-2_0-0-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgdk_pixbuf-2_0-0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libgdk_pixbuf-2_0-0-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-GdkPixbuf-2_0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/07/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/07/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.3\", reference:\"gdk-pixbuf-debugsource-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"gdk-pixbuf-devel-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"gdk-pixbuf-devel-debuginfo-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"gdk-pixbuf-lang-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"gdk-pixbuf-query-loaders-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"gdk-pixbuf-query-loaders-debuginfo-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libgdk_pixbuf-2_0-0-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libgdk_pixbuf-2_0-0-debuginfo-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"typelib-1_0-GdkPixbuf-2_0-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"gdk-pixbuf-devel-32bit-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"gdk-pixbuf-devel-debuginfo-32bit-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"gdk-pixbuf-query-loaders-32bit-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"gdk-pixbuf-query-loaders-debuginfo-32bit-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libgdk_pixbuf-2_0-0-32bit-2.34.0-16.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libgdk_pixbuf-2_0-0-debuginfo-32bit-2.34.0-16.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gdk-pixbuf-debugsource / gdk-pixbuf-devel / gdk-pixbuf-devel-32bit / etc\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-12-02T15:24:52", "references": ["https://bugzilla.suse.com/show_bug.cgi?id=1074462", "http://www.nessus.org/u?f25d061f", "https://www.suse.com/security/cve/CVE-2017-1000422/"], "pluginID": "111102", "description": "This update for gdk-pixbuf fixes the following security issue :\n\n - CVE-2017-1000422: Prevent several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution (bsc#1074462).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 5, "reporter": "Tenable", "published": "2018-07-16T00:00:00", "title": "SUSE SLED12 / SLES12 Security Update : gdk-pixbuf (SUSE-SU-2018:1950-1)", "type": "nessus", "enchantments": {"score": {"modified": "2018-12-02T15:24:52", "vector": "NONE", "value": 7.5}}, "naslFamily": "SuSE Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000422"], "modified": "2018-12-01T00:00:00", "cpe": ["cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:libgdk_pixbuf-2_0", "p-cpe:/a:novell:suse_linux:gdk-pixbuf-query-loaders", "p-cpe:/a:novell:suse_linux:gdk-pixbuf-debugsource", "p-cpe:/a:novell:suse_linux:gdk-pixbuf-query-loaders-debuginfo", "p-cpe:/a:novell:suse_linux:libgdk_pixbuf-2_0-0", "p-cpe:/a:novell:suse_linux:libgdk_pixbuf-2_0-0-debuginfo", "p-cpe:/a:novell:suse_linux:typelib-1_0-GdkPixbuf"], "id": "SUSE_SU-2018-1950-1.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=111102", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:1950-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(111102);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2018/12/01 13:19:05\");\n\n script_cve_id(\"CVE-2017-1000422\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : gdk-pixbuf (SUSE-SU-2018:1950-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for gdk-pixbuf fixes the following security issue :\n\n - CVE-2017-1000422: Prevent several integer overflow in\n the gif_get_lzw function resulting in memory corruption\n and potential code execution (bsc#1074462).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1074462\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-1000422/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20181950-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f25d061f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t\npatch SUSE-SLE-SDK-12-SP3-2018-1322=1\n\nSUSE Linux Enterprise Server 12-SP3:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-2018-1322=1\n\nSUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP3-2018-1322=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:gdk-pixbuf-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:gdk-pixbuf-query-loaders\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:gdk-pixbuf-query-loaders-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libgdk_pixbuf-2_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libgdk_pixbuf-2_0-0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libgdk_pixbuf-2_0-0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:typelib-1_0-GdkPixbuf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/07/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = eregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! ereg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP3\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! ereg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"gdk-pixbuf-debugsource-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"gdk-pixbuf-query-loaders-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"gdk-pixbuf-query-loaders-debuginfo-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libgdk_pixbuf-2_0-0-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libgdk_pixbuf-2_0-0-debuginfo-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"typelib-1_0-GdkPixbuf-2_0-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"gdk-pixbuf-query-loaders-32bit-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"gdk-pixbuf-query-loaders-debuginfo-32bit-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libgdk_pixbuf-2_0-0-32bit-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libgdk_pixbuf-2_0-0-debuginfo-32bit-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"gdk-pixbuf-debugsource-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"gdk-pixbuf-query-loaders-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"gdk-pixbuf-query-loaders-32bit-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"gdk-pixbuf-query-loaders-debuginfo-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"gdk-pixbuf-query-loaders-debuginfo-32bit-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libgdk_pixbuf-2_0-0-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libgdk_pixbuf-2_0-0-32bit-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libgdk_pixbuf-2_0-0-debuginfo-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libgdk_pixbuf-2_0-0-debuginfo-32bit-2.34.0-19.11.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"typelib-1_0-GdkPixbuf-2_0-2.34.0-19.11.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gdk-pixbuf\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-12-06T01:43:34", "references": ["http://www.nessus.org/u?e150a8ad"], "pluginID": "106774", "description": "According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.(CVE-2017-2862)\n\n - An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.(CVE-2017-2870)\n\n - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution(CVE-2017-1000422)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 46, "reporter": "Tenable", "published": "2018-02-13T00:00:00", "title": "EulerOS 2.0 SP2 : gdk-pixbuf2 (EulerOS-SA-2018-1046)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "Huawei Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-2870", "CVE-2017-2862", "CVE-2017-1000422"], "modified": "2018-12-04T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:gdk-pixbuf2", "p-cpe:/a:huawei:euleros:gdk-pixbuf2-devel", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2018-1046.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=106774", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106774);\n script_version(\"3.43\");\n script_cvs_date(\"Date: 2018/12/04 11:21:23\");\n\n script_cve_id(\n \"CVE-2017-1000422\",\n \"CVE-2017-2862\",\n \"CVE-2017-2870\"\n );\n\n script_name(english:\"EulerOS 2.0 SP2 : gdk-pixbuf2 (EulerOS-SA-2018-1046)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the gdk-pixbuf2 packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - An exploitable heap overflow vulnerability exists in\n the gdk_pixbuf__jpeg_image_load_increment functionality\n of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can\n cause a heap overflow resulting in remote code\n execution. An attacker can send a file or url to\n trigger this vulnerability.(CVE-2017-2862)\n\n - An exploitable integer overflow vulnerability exists in\n the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6\n when compiled with Clang. A specially crafted tiff file\n can cause a heap-overflow resulting in remote code\n execution. An attacker can send a file or a URL to\n trigger this vulnerability.(CVE-2017-2870)\n\n - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to\n several integer overflow in the gif_get_lzw function\n resulting in memory corruption and potential code\n execution(CVE-2017-1000422)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huawei.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1046\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e150a8ad\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected gdk-pixbuf2 packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:gdk-pixbuf2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:gdk-pixbuf2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\n\nflag = 0;\n\npkgs = [\"gdk-pixbuf2-2.31.6-3.h3\",\n \"gdk-pixbuf2-devel-2.31.6-3.h3\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gdk-pixbuf2\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-12-12T03:51:28", "references": ["http://www.nessus.org/u?619b937e"], "pluginID": "106773", "description": "According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.(CVE-2017-2862)\n\n - An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.(CVE-2017-2870)\n\n - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution(CVE-2017-1000422)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 44, "reporter": "Tenable", "published": "2018-02-13T00:00:00", "title": "EulerOS 2.0 SP1 : gdk-pixbuf2 (EulerOS-SA-2018-1045)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 6.8}}, "naslFamily": "Huawei Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-2870", "CVE-2017-2862", "CVE-2017-1000422"], "modified": "2018-12-11T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:gdk-pixbuf2", "p-cpe:/a:huawei:euleros:gdk-pixbuf2-devel", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2018-1045.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=106773", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106773);\n script_version(\"3.43\");\n script_cvs_date(\"Date: 2018/12/11 12:42:59\");\n\n script_cve_id(\n \"CVE-2017-1000422\",\n \"CVE-2017-2862\",\n \"CVE-2017-2870\"\n );\n\n script_name(english:\"EulerOS 2.0 SP1 : gdk-pixbuf2 (EulerOS-SA-2018-1045)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the gdk-pixbuf2 packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - An exploitable heap overflow vulnerability exists in\n the gdk_pixbuf__jpeg_image_load_increment functionality\n of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can\n cause a heap overflow resulting in remote code\n execution. An attacker can send a file or url to\n trigger this vulnerability.(CVE-2017-2862)\n\n - An exploitable integer overflow vulnerability exists in\n the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6\n when compiled with Clang. A specially crafted tiff file\n can cause a heap-overflow resulting in remote code\n execution. An attacker can send a file or a URL to\n trigger this vulnerability.(CVE-2017-2870)\n\n - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to\n several integer overflow in the gif_get_lzw function\n resulting in memory corruption and potential code\n execution(CVE-2017-1000422)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huawei.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1045\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?619b937e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected gdk-pixbuf2 packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:gdk-pixbuf2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:gdk-pixbuf2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(1)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\n\nflag = 0;\n\npkgs = [\"gdk-pixbuf2-2.31.6-3.h3\",\n \"gdk-pixbuf2-devel-2.31.6-3.h3\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"1\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gdk-pixbuf2\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-12-02T15:28:35", "references": ["https://usn.ubuntu.com/3532-1/"], "pluginID": "106074", "description": "It was discoreved that GDK-PixBuf incorrectly handled certain gif images. An attacker could use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2017-1000422)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled certain images. An attacker could use this to cause a denial of service. (CVE-2017-6312, CVE-2017-6313)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled large TIFF files. An attacker could use this to cause a denial of service.\n(CVE-2017-6314).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 8, "reporter": "Tenable", "published": "2018-01-16T00:00:00", "title": "Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : gdk-pixbuf vulnerabilities (USN-3532-1)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Ubuntu Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-6312", "CVE-2017-6313", "CVE-2017-6314", "CVE-2017-1000422"], "modified": "2018-12-01T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:17.10", "cpe:/o:canonical:ubuntu_linux:16.04", "p-cpe:/a:canonical:ubuntu_linux:libgdk-pixbuf2.0-0", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3532-1.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=106074", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3532-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106074);\n script_version(\"3.6\");\n script_cvs_date(\"Date: 2018/12/01 15:12:41\");\n\n script_cve_id(\"CVE-2017-1000422\", \"CVE-2017-6312\", \"CVE-2017-6313\", \"CVE-2017-6314\");\n script_xref(name:\"USN\", value:\"3532-1\");\n\n script_name(english:\"Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : gdk-pixbuf vulnerabilities (USN-3532-1)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discoreved that GDK-PixBuf incorrectly handled certain gif\nimages. An attacker could use this to execute arbitrary code. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2017-1000422)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled\ncertain images. An attacker could use this to cause a denial of\nservice. (CVE-2017-6312, CVE-2017-6313)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled large\nTIFF files. An attacker could use this to cause a denial of service.\n(CVE-2017-6314).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3532-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libgdk-pixbuf2.0-0 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libgdk-pixbuf2.0-0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:17.10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2018 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(14\\.04|16\\.04|17\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04 / 16.04 / 17.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"libgdk-pixbuf2.0-0\", pkgver:\"2.30.7-0ubuntu1.8\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"libgdk-pixbuf2.0-0\", pkgver:\"2.32.2-1ubuntu1.4\")) flag++;\nif (ubuntu_check(osver:\"17.10\", pkgname:\"libgdk-pixbuf2.0-0\", pkgver:\"2.36.11-1ubuntu0.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libgdk-pixbuf2.0-0\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "suse": [{"lastseen": "2018-07-20T05:36:34", "references": ["https://bugzilla.suse.com/1074462"], "affectedPackage": [{"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "i586", "packageFilename": "gdk-pixbuf-query-loaders-debuginfo-2.34.0-16.1.i586.rpm", "packageName": "gdk-pixbuf-query-loaders-debuginfo", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "noarch", "packageFilename": "gdk-pixbuf-lang-2.34.0-16.1.noarch.rpm", "packageName": "gdk-pixbuf-lang", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "gdk-pixbuf-devel-2.34.0-16.1.x86_64.rpm", "packageName": "gdk-pixbuf-devel", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "i586", "packageFilename": "libgdk_pixbuf-2_0-0-2.34.0-16.1.i586.rpm", "packageName": "libgdk_pixbuf-2_0-0", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "i586", "packageFilename": "gdk-pixbuf-devel-debuginfo-2.34.0-16.1.i586.rpm", "packageName": "gdk-pixbuf-devel-debuginfo", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "libgdk_pixbuf-2_0-0-32bit-2.34.0-16.1.x86_64.rpm", "packageName": "libgdk_pixbuf-2_0-0-32bit", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "gdk-pixbuf-query-loaders-debuginfo-2.34.0-16.1.x86_64.rpm", "packageName": "gdk-pixbuf-query-loaders-debuginfo", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "gdk-pixbuf-query-loaders-debuginfo-32bit-2.34.0-16.1.x86_64.rpm", "packageName": "gdk-pixbuf-query-loaders-debuginfo-32bit", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "i586", "packageFilename": "gdk-pixbuf-debugsource-2.34.0-16.1.i586.rpm", "packageName": "gdk-pixbuf-debugsource", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "typelib-1_0-GdkPixbuf-2_0-2.34.0-16.1.x86_64.rpm", "packageName": "typelib-1_0-GdkPixbuf-2_0", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "gdk-pixbuf-devel-32bit-2.34.0-16.1.x86_64.rpm", "packageName": "gdk-pixbuf-devel-32bit", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "gdk-pixbuf-debugsource-2.34.0-16.1.x86_64.rpm", "packageName": "gdk-pixbuf-debugsource", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "i586", "packageFilename": "libgdk_pixbuf-2_0-0-debuginfo-2.34.0-16.1.i586.rpm", "packageName": "libgdk_pixbuf-2_0-0-debuginfo", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "gdk-pixbuf-devel-debuginfo-2.34.0-16.1.x86_64.rpm", "packageName": "gdk-pixbuf-devel-debuginfo", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "libgdk_pixbuf-2_0-0-debuginfo-2.34.0-16.1.x86_64.rpm", "packageName": "libgdk_pixbuf-2_0-0-debuginfo", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "gdk-pixbuf-query-loaders-2.34.0-16.1.x86_64.rpm", "packageName": "gdk-pixbuf-query-loaders", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "i586", "packageFilename": "typelib-1_0-GdkPixbuf-2_0-2.34.0-16.1.i586.rpm", "packageName": "typelib-1_0-GdkPixbuf-2_0", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "gdk-pixbuf-query-loaders-32bit-2.34.0-16.1.x86_64.rpm", "packageName": "gdk-pixbuf-query-loaders-32bit", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "gdk-pixbuf-devel-debuginfo-32bit-2.34.0-16.1.x86_64.rpm", "packageName": "gdk-pixbuf-devel-debuginfo-32bit", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "libgdk_pixbuf-2_0-0-2.34.0-16.1.x86_64.rpm", "packageName": "libgdk_pixbuf-2_0-0", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "x86_64", "packageFilename": "libgdk_pixbuf-2_0-0-debuginfo-32bit-2.34.0-16.1.x86_64.rpm", "packageName": "libgdk_pixbuf-2_0-0-debuginfo-32bit", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "i586", "packageFilename": "gdk-pixbuf-query-loaders-2.34.0-16.1.i586.rpm", "packageName": "gdk-pixbuf-query-loaders", "operator": "lt"}, {"OS": "openSUSE Leap", "OSVersion": "42.3", "packageVersion": "2.34.0-16.1", "arch": "i586", "packageFilename": "gdk-pixbuf-devel-2.34.0-16.1.i586.rpm", "packageName": "gdk-pixbuf-devel", "operator": "lt"}], "description": "This update for gdk-pixbuf fixes the following security issue:\n\n - CVE-2017-1000422: Prevent several integer overflow in the gif_get_lzw\n function resulting in memory corruption and potential code execution\n (bsc#1074462).\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\n\n", "edition": 1, "reporter": "Suse", "published": "2018-07-20T03:09:26", "title": "Security update for gdk-pixbuf (moderate)", "type": "suse", "enchantments": {"score": {"modified": "2018-07-20T05:36:34", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000422"], "modified": "2018-07-20T03:09:26", "id": "OPENSUSE-SU-2018:2013-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-07/msg00025.html", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "cloudfoundry": [{"lastseen": "2018-09-11T21:26:25", "references": [], "description": "# \n\n# Severity\n\nMedium\n\n# Vendor\n\nCanonical Ubuntu\n\n# Versions Affected\n\n * Canonical Ubuntu 14.04\n\n# Description\n\nIt was discoreved that GDK-PixBuf incorrectly handled certain gif images. An attacker could use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-1000422)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled certain images. An attacker could use this to cause a denial of service. (CVE-2017-6312, CVE-2017-6313)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled large TIFF files. An attacker could use this to cause a denial of service. (CVE-2017-6314)\n\n# Affected Cloud Foundry Products and Versions\n\n_Severity is medium unless otherwise noted._\n\n * All versions of Cloud Foundry cflinuxfs2 prior to 1.180.0\n\n# Mitigation\n\nOSS users are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs2 version 1.180.0 or later.\n\n# References\n\n * [USN-3532-1](<https://usn.ubuntu.com/3532-1>)\n * [CVE-2017-1000422](<https://people.canonical.com/~ubuntu-security/cve/CVE-2017-1000422>)\n * [CVE-2017-6312](<https://people.canonical.com/~ubuntu-security/cve/CVE-2017-6312>)\n * [CVE-2017-6313](<https://people.canonical.com/~ubuntu-security/cve/CVE-2017-6313>)\n * [CVE-2017-6314](<https://people.canonical.com/~ubuntu-security/cve/CVE-2017-6314>)\n", "edition": 1, "reporter": "Cloud Foundry", "published": "2018-01-24T00:00:00", "title": "USN-3532-1: GDK-PixBuf vulnerabilities | Cloud Foundry", "type": "cloudfoundry", "enchantments": {"score": {"modified": "2018-09-11T21:26:25", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2017-6312", "CVE-2017-6313", "CVE-2017-6314", "CVE-2017-1000422"], "modified": "2018-01-24T00:00:00", "id": "CFOUNDRY:5FCFF3F01CC96D4AE9302EFAC9ADC855", "href": "https://www.cloudfoundry.org/blog/usn-3532-1/", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "ubuntu": [{"lastseen": "2018-08-31T00:09:19", "references": ["https://people.canonical.com/~ubuntu-security/cve/CVE-2017-6312", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-1000422", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-6313", "https://people.canonical.com/~ubuntu-security/cve/CVE-2017-6314"], "affectedPackage": [{"OS": "Ubuntu", "OSVersion": "17.10", "packageVersion": "2.36.11-1ubuntu0.1", "arch": "noarch", "packageFilename": "UNKNOWN", "packageName": "libgdk-pixbuf2.0-0", "operator": "lt"}, {"OS": "Ubuntu", "OSVersion": "14.04", "packageVersion": "2.30.7-0ubuntu1.8", "arch": "noarch", "packageFilename": "UNKNOWN", "packageName": "libgdk-pixbuf2.0-0", "operator": "lt"}, {"OS": "Ubuntu", "OSVersion": "16.04", "packageVersion": "2.32.2-1ubuntu1.4", "arch": "noarch", "packageFilename": "UNKNOWN", "packageName": "libgdk-pixbuf2.0-0", "operator": "lt"}], "description": "It was discoreved that GDK-PixBuf incorrectly handled certain gif images. An attacker could use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-1000422)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled certain images. An attacker could use this to cause a denial of service. (CVE-2017-6312, CVE-2017-6313)\n\nAriel Zelivansky discovered that GDK-PixBuf incorrectly handled large TIFF files. An attacker could use this to cause a denial of service. (CVE-2017-6314)", "edition": 3, "reporter": "Ubuntu", "published": "2018-01-15T00:00:00", "title": "GDK-PixBuf vulnerabilities", "type": "ubuntu", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "unix", "cvelist": ["CVE-2017-6312", "CVE-2017-6313", "CVE-2017-6314", "CVE-2017-1000422"], "modified": "2018-01-15T00:00:00", "id": "USN-3532-1", "href": "https://usn.ubuntu.com/3532-1/", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}