gtk+2.0 -- several vulnerabilities

ID DSA-911
Type debian
Reporter Debian
Modified 2005-11-29T00:00:00


Several vulnerabilities have been found in gtk+2.0, the Gtk+ GdkPixBuf XPM image rendering library. The Common Vulnerabilities and Exposures project identifies the following problems:

Ludwig Nussel discovered an infinite loop when processing XPM images that allows an attacker to cause a denial of service via a specially crafted XPM file.

Ludwig Nussel discovered an integer overflow in the way XPM images are processed that could lead to the execution of arbitrary code or crash the application via a specially crafted XPM file.

"infamous41md" discovered an integer overflow in the XPM processing routine that can be used to execute arbitrary code via a traditional heap overflow.

The following matrix explains which versions fix these problems:

| old stable (woody) | stable (sarge) | unstable (sid)
gdk-pixbuf | 0.17.0-2woody3 | 0.22.0-8.1 | 0.22.0-11
gtk+2.0 | 2.0.2-5woody3 | 2.6.4-3.1 | 2.6.10-2

We recommend that you upgrade your gtk+2.0 packages.