search menu icon-carat-right cmu-wordmark

CERT Coordination Center

GdkPixbuf XPM parser contains a stack overflow vulnerability

Vulnerability Note VU#369358

Original Release Date: 2004-10-01 | Last Revised: 2004-10-28

Overview

A stack overflow vulnerability exists in the XPM handling of GdkPixbuf. This vulnerability can lead to a denial-of-service condition or execution of arbitrary code.

Description

GdkPixbuf is a library used by GTK+ 2 for loading and rendering images. GTK+ is a multi-platform toolkit for creating graphical user interfaces. It is used by the Gnome desktop and other applications. GdkPixbuf contains a stack overflow vulnerability in the xpm_extract_color() function of the XPM loading routine.

Impact

By convincing the user to open a specially crafted XPM file, an attacker could cause a denial of service by crashing the application that uses GdkPixbuf. It may also be possible to execute arbitrary code with the permissions of that application.

Solution

Apply a patch from your vendor

For vendor-specific information regarding vulnerable status and patch availability, please see the vendor section of this document.

Upgrade your version of gtk+

Upgrade your system as specified by your vendor. If you need to compile the software from the original source, get gtk+ 2.4.10.

Vendor Information

369358
 

View all 35 vendors View less vendors


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

Thanks to Chris Evans for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

CVE IDs: CVE-2004-0783
Severity Metric: 8.86
Date Public: 2004-09-15
Date First Published: 2004-10-01
Date Last Updated: 2004-10-28 13:57 UTC
Document Revision: 14

Sponsored by CISA.