CVE-2012-2370

Multiple integer overflows in the read_bitmap_file_data function in
io-xbm.c in gdk-pixbuf before 2.26.1 allow remote attackers to cause a
denial of service (application crash) via a negative (1) height or (2)
width in an XBM file, which triggers a heap-based buffer overflow.

Bugs

• <https://bugs.gentoo.org/show_bug.cgi?id=412033&gt;
• <https://bugs.launchpad.net/ubuntu/+source/gdk-pixbuf/+bug/681150&gt;
• <https://bugzilla.gnome.org/show_bug.cgi?id=672811&gt;

Notes