Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2004-2021 Tenable Network Security, Inc.MANDRAKE_MDKSA-2004-095.NASL
HistorySep 16, 2004 - 12:00 a.m.

Mandrake Linux Security Advisory : gdk-pixbuf/gtk+2 (MDKSA-2004:095-1)

2004-09-1600:00:00
This script is Copyright (C) 2004-2021 Tenable Network Security, Inc.
www.tenable.com
8
JSON

A vulnerability was found in the gdk-pixbug bmp loader where a bad BMP image could send the bmp loader into an infinite loop (CVE-2004-0753).

Chris Evans found a heap-based overflow and a stack-based overflow in the xpm loader of gdk-pixbuf (CVE-2004-0782 and CVE-2004-0783).

Chris Evans also discovered an integer overflow in the ico loader of gdk-pixbuf (CVE-2004-0788).

All four problems have been corrected in these updated packages.

Update :

The previous package had an incorrect patch applied that would cause some problems with other programs. The updated packages have the correct patch applied.

As well, patched gtk+2 packages, which also contain gdk-pixbuf, are now provided.

#%NASL_MIN_LEVEL 70300

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Mandrake Linux Security Advisory MDKSA-2004:095. 
# The text itself is copyright (C) Mandriva S.A.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(14751);
  script_version("1.20");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/06");

  script_cve_id("CVE-2004-0753", "CVE-2004-0782", "CVE-2004-0783", "CVE-2004-0788");
  script_xref(name:"MDKSA", value:"2004:095-1");

  script_name(english:"Mandrake Linux Security Advisory : gdk-pixbuf/gtk+2 (MDKSA-2004:095-1)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Mandrake Linux host is missing one or more security
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"A vulnerability was found in the gdk-pixbug bmp loader where a bad BMP
image could send the bmp loader into an infinite loop (CVE-2004-0753).

Chris Evans found a heap-based overflow and a stack-based overflow in
the xpm loader of gdk-pixbuf (CVE-2004-0782 and CVE-2004-0783).

Chris Evans also discovered an integer overflow in the ico loader of
gdk-pixbuf (CVE-2004-0788).

All four problems have been corrected in these updated packages.

Update :

The previous package had an incorrect patch applied that would cause
some problems with other programs. The updated packages have the
correct patch applied.

As well, patched gtk+2 packages, which also contain gdk-pixbuf, are
now provided."
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:gdk-pixbuf-loaders");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:gtk+2.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gdk-pixbuf-gnomecanvas1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gdk-pixbuf-xlib2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gdk-pixbuf2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gdk-pixbuf2-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gdk_pixbuf2.0_0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gdk_pixbuf2.0_0-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gtk+-linuxfb-2.0_0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gtk+-linuxfb-2.0_0-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gtk+-x11-2.0_0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gtk+2.0_0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64gtk+2.0_0-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgdk-pixbuf-gnomecanvas1");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgdk-pixbuf-xlib2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgdk-pixbuf2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgdk-pixbuf2-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgdk_pixbuf2.0_0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgdk_pixbuf2.0_0-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgtk+-linuxfb-2.0_0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgtk+-linuxfb-2.0_0-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgtk+-x11-2.0_0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgtk+2.0_0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libgtk+2.0_0-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:9.2");

  script_set_attribute(attribute:"patch_publication_date", value:"2004/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/16");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2004-2021 Tenable Network Security, Inc.");
  script_family(english:"Mandriva Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);


flag = 0;
if (rpm_check(release:"MDK10.0", reference:"gdk-pixbuf-loaders-0.22.0-2.2.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"gtk+2.0-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.2.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gdk-pixbuf-xlib2-0.22.0-2.2.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gdk-pixbuf2-0.22.0-2.2.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gdk-pixbuf2-devel-0.22.0-2.2.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gdk_pixbuf2.0_0-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gdk_pixbuf2.0_0-devel-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gtk+-linuxfb-2.0_0-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gtk+-linuxfb-2.0_0-devel-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gtk+-x11-2.0_0-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gtk+2.0_0-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64gtk+2.0_0-devel-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgdk-pixbuf-gnomecanvas1-0.22.0-2.2.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgdk-pixbuf-xlib2-0.22.0-2.2.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgdk-pixbuf2-0.22.0-2.2.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgdk-pixbuf2-devel-0.22.0-2.2.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgdk_pixbuf2.0_0-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgdk_pixbuf2.0_0-devel-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgtk+-linuxfb-2.0_0-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgtk+-linuxfb-2.0_0-devel-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgtk+-x11-2.0_0-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgtk+2.0_0-2.2.4-10.1.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libgtk+2.0_0-devel-2.2.4-10.1.100mdk", yank:"mdk")) flag++;

if (rpm_check(release:"MDK9.2", reference:"gdk-pixbuf-loaders-0.22.0-2.2.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", reference:"gtk+2.0-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.2.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gdk-pixbuf-xlib2-0.22.0-2.2.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gdk-pixbuf2-0.22.0-2.2.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gdk-pixbuf2-devel-0.22.0-2.2.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gdk_pixbuf2.0_0-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gdk_pixbuf2.0_0-devel-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gtk+-linuxfb-2.0_0-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gtk+-linuxfb-2.0_0-devel-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gtk+-x11-2.0_0-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gtk+2.0_0-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"amd64", reference:"lib64gtk+2.0_0-devel-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgdk-pixbuf-gnomecanvas1-0.22.0-2.2.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgdk-pixbuf-xlib2-0.22.0-2.2.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgdk-pixbuf2-0.22.0-2.2.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgdk-pixbuf2-devel-0.22.0-2.2.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgdk_pixbuf2.0_0-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgdk_pixbuf2.0_0-devel-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgtk+-linuxfb-2.0_0-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgtk+-linuxfb-2.0_0-devel-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgtk+-x11-2.0_0-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgtk+2.0_0-2.2.4-2.1.92mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK9.2", cpu:"i386", reference:"libgtk+2.0_0-devel-2.2.4-2.1.92mdk", yank:"mdk")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
VendorProductVersionCPE
mandrivalinuxgdk-pixbuf-loadersp-cpe:/a:mandriva:linux:gdk-pixbuf-loaders
mandrivalinuxgtk%2b2.0p-cpe:/a:mandriva:linux:gtk%2b2.0
mandrivalinuxlib64gdk-pixbuf-gnomecanvas1p-cpe:/a:mandriva:linux:lib64gdk-pixbuf-gnomecanvas1
mandrivalinuxlib64gdk-pixbuf-xlib2p-cpe:/a:mandriva:linux:lib64gdk-pixbuf-xlib2
mandrivalinuxlib64gdk-pixbuf2p-cpe:/a:mandriva:linux:lib64gdk-pixbuf2
mandrivalinuxlib64gdk-pixbuf2-develp-cpe:/a:mandriva:linux:lib64gdk-pixbuf2-devel
mandrivalinuxlib64gdk_pixbuf2.0_0p-cpe:/a:mandriva:linux:lib64gdk_pixbuf2.0_0
mandrivalinuxlib64gdk_pixbuf2.0_0-develp-cpe:/a:mandriva:linux:lib64gdk_pixbuf2.0_0-devel
mandrivalinuxlib64gtk%2b-linuxfb-2.0_0p-cpe:/a:mandriva:linux:lib64gtk%2b-linuxfb-2.0_0
mandrivalinuxlib64gtk%2b-linuxfb-2.0_0-develp-cpe:/a:mandriva:linux:lib64gtk%2b-linuxfb-2.0_0-devel
Rows per page:
1-10 of 261

Related

gentoo 1
nessus 15
openvas 12
cert 4
redhat 2
freebsd 2
debian 4
osv 2
securityvulns 2
checkpoint_advisories 1
debiancve 4
ubuntucve 4
cve 4
suse 2
gentoo
gentoo
GTK+ 2, gdk-pixbuf: Multiple image decoding vulnerabilities
2004-09-21 00:00:00
nessus
nessus
GLSA-200409-28 : GTK+ 2, gdk-pixbuf: Multiple image decoding vulnerabilities
2004-09-22 00:00:00
Debian DSA-546-1 : gdk-pixbuf - several vulnerabilities
2004-09-29 00:00:00
Fedora Core 1 : gdk-pixbuf-0.22.0-11.2.2 (2004-286)
2004-09-15 00:00:00
openvas
openvas
Gentoo Security Advisory GLSA 200409-28 (gtk+)
2008-09-24 00:00:00
Gentoo Security Advisory GLSA 200409-28 (gtk+)
2008-09-24 00:00:00
SLES9: Security update for gdk-pixbuf
2009-10-10 00:00:00
cert
cert
GdkPixbuf BMP parser may enter an infinite loop
2004-10-01 00:00:00
GdkPixbuf XPM parser contains a heap overflow vulnerability
2004-10-01 00:00:00
GdkPixbuf ICO parser contains an integer overflow vulnerability
2004-10-01 00:00:00
redhat
redhat
(RHSA-2004:466) gtk2 security update
2004-09-15 00:00:00
(RHSA-2004:447) gdk-pixbuf security update
2004-09-15 00:00:00
freebsd
freebsd
gdk-pixbuf -- image decoding vulnerabilities
2004-09-15 00:00:00
imlib -- xpm heap buffer overflows and integer overflows
2004-12-06 00:00:00
debian
debian
[SECURITY] [DSA 549-1] New gtk+2.0 packages fix several vulnerabilities
2004-09-17 00:00:00
[SECURITY] [DSA 549-1] New gtk+2.0 packages fix several vulnerabilities
2004-09-17 09:25:18
[SECURITY] [DSA 546-1] New gdk-pixbuf packages fix several vulnerabilities
2004-09-16 09:02:33
osv
osv
gtk+2.0 - multiple holes
2004-09-17 00:00:00
gdk-pixbuf - several vulnerabilities
2004-09-16 00:00:00
securityvulns
securityvulns
CESA-2004-005: gtk+ XPM decoder
2004-09-16 00:00:00
CESA-2004-004: libXpm
2004-09-16 00:00:00
checkpoint_advisories
checkpoint_advisories
CVS File Existence Information Disclosure (CVE-2004-0788)
2009-10-14 00:00:00
debiancve
debiancve
CVE-2004-0788
2004-10-20 04:00:00
CVE-2004-0753
2004-10-20 04:00:00
CVE-2004-0782
2004-10-20 04:00:00
ubuntucve
ubuntucve
CVE-2004-0788
2004-10-20 00:00:00
CVE-2004-0753
2004-10-20 00:00:00
CVE-2004-0782
2004-10-20 00:00:00
cve
cve
CVE-2004-0788
2004-10-20 04:00:00
CVE-2004-0753
2004-10-20 04:00:00
CVE-2004-0782
2004-10-20 04:00:00
suse
suse
remote code execution in gtk2, gdk-pixbuf
2004-09-17 10:02:50
remote denial-of-service in apache2
2004-09-15 15:46:39
JSON
Related for MANDRAKE_MDKSA-2004-095.NASL
gentoo1nessus15openvas12cert4redhat2freebsd2debian4osv2securityvulns2checkpoint_advisories1debiancve4ubuntucve4cve4suse2