PT-2004-1015 · Debian · Gtksee

Published 2004-03-10 · Updated 2017-07-11 · CVE-2003-0444

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GTKSee versions 0.5 through 0.5.1

Description The issue concerns multiple vulnerabilities in the GTKSee package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, a heap-based buffer overflow in GTKSee versions 0.5 and 0.5.1 allows remote attackers to execute arbitrary code via a PNG image of certain color depths.

Recommendations For GTKSee versions 0.5 and 0.5.1, consider disabling the handling of PNG images until a patch is available. Restrict access to the GTKSee package to minimize the risk of exploitation. Avoid using the GTKSee package for processing untrusted images until the issue is resolved.

Fix

Related Identifiers

BDU:2015-02819

CVE-2003-0444

DSA-337

Affected Products

Gtksee

References · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0444 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2003-0444 · Security Note
• http://securityfocus.com/bid/8061 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02819 · Security Note
• http://debian.org/security/2003/dsa-337 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12462 · Note
• http://debian.org/security/dsa-337 · Note