National Cyber Awareness System

Vulnerability Summary for CVE-2012-2370

Overview

Multiple integer overflows in the read_bitmap_file_data function in io-xbm.c in gdk-pixbuf before 2.26.1 allow remote attackers to cause a denial of service (application crash) via a negative (1) height or (2) width in an XBM file, which triggers a heap-based buffer overflow.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://git.gnome.org/browse/gdk-pixbuf/commit/?id=b1bb3053856aede37d473c92f0e5a10e29f10516

Type: Patch Information

Hyperlink:http://git.gnome.org/browse/gdk-pixbuf/commit/?id=b1bb3053856aede37d473c92f0e5a10e29f10516

External Source: CONFIRM

Name: http://git.gnome.org/browse/gdk-pixbuf/commit/?id=4f0f465f991cd454d03189497f923eb40c170c22

Type: Patch Information; Exploit

Hyperlink:http://git.gnome.org/browse/gdk-pixbuf/commit/?id=4f0f465f991cd454d03189497f923eb40c170c22

External Source: MISC

Name: https://bugs.launchpad.net/ubuntu/+source/gdk-pixbuf/+bug/681150

Hyperlink:https://bugs.launchpad.net/ubuntu/+source/gdk-pixbuf/+bug/681150

External Source: XF

Name: gdkpixbuf-readbitmapfiledata-bo(75578)

Hyperlink:http://xforce.iss.net/xforce/xfdb/75578

External Source: BID

Name: 53548

Hyperlink:http://www.securityfocus.com/bid/53548

External Source: MLIST

Name: [oss-security] 20120515 Re: CVE Request: gdk-pixbuf Integer overflow in XBM file loader

Hyperlink:http://www.openwall.com/lists/oss-security/2012/05/15/9

External Source: MLIST

Name: [oss-security] 20120515 CVE Request: gdk-pixbuf Integer overflow in XBM file loader

Hyperlink:http://www.openwall.com/lists/oss-security/2012/05/15/8

External Source: GENTOO

Name: GLSA-201206-20

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-201206-20.xml

External Source: SECUNIA

Name: 49715

Type: Advisory

Hyperlink:http://secunia.com/advisories/49715

External Source: SECUNIA

Name: 49125

Type: Advisory

Hyperlink:http://secunia.com/advisories/49125

External Source: REDHAT

Name: RHSA-2013:0135

Hyperlink:http://rhn.redhat.com/errata/RHSA-2013-0135.html

External Source: MISC

Name: http://git.gnome.org/browse/gdk-pixbuf/

Hyperlink:http://git.gnome.org/browse/gdk-pixbuf/