[SECURITY] [DLA 450-1] gdk-pixbuf security update

Package : gdk-pixbuf
Version : 2.26.1-1+deb7u4
CVE ID : CVE-2015-7552 CVE-2015-7674

A heap-based buffer overflow has been discovered in gdk-pixbuf, a
library for image loading and saving facilities, fast scaling and
compositing of pixbufs, that allows remote attackers to cause a denial
of service or possibly execute arbitrary code via a crafted BMP file.

This update also fixes an incomplete patch for CVE-2015-7674.

CVE-2015-7552
Heap-based buffer overflow in the gdk_pixbuf_flip function in
gdk-pixbuf-scale.c in gdk-pixbuf allows remote attackers to cause a
denial of service or possibly execute arbitrary code via a crafted
BMP file.

CVE-2015-7674
Integer overflow in the pixops_scale_nearest function in
pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers
to cause a denial of service (application crash) and possibly
execute arbitrary code via a crafted GIF image file, which triggers
a heap-based buffer overflow.

For Debian 7 "Wheezy", these problems have been fixed in version
2.26.1-1+deb7u4.

We recommend that you upgrade your gdk-pixbuf packages.