PT-2004-3765 · Gtk+ · Gtk2+1

Chris Evans · Published 1970-01-01 · Updated 2023-08-11 · CVE-2004-0782

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions gtk2 versions 2.4.4 and earlier gdk-pixbuf versions prior to 0.22

Description The issue is related to multiple vulnerabilities in the gtk2 and gdk-pixbuf packages, which can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be done remotely. Specifically, an integer overflow in the pixbuf create from xpm function in the XPM image decoder for gtk+ 2.4.4 and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n col and cpp values that enable a heap-based buffer overflow.

Recommendations For gtk2 versions 2.4.4 and earlier, consider updating to a version later than 2.4.4 to resolve the issue. For gdk-pixbuf versions prior to 0.22, consider updating to version 0.22 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XPM image decoder in the affected packages until a patch is available.

Fix

Related Identifiers

BDU:2015-04801

BDU:2015-04802

CVE-2004-0782

DSA-546-1

DSA-549-1

RHSA-2004:447

RHSA-2004:466

Affected Products

Gdk-Pixbuf

Gtk2

References · 24

• https://security-tracker.debian.org/tracker/CVE-2004-0782 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000875 · Vendor Advisory
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:095 · Vendor Advisory
• https://bugzilla.fedora.us/show_bug.cgi?id=2005 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04802 · Security Note
• http://securityfocus.com/archive/1/419771/100/0/threaded · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-447.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0782 · Security Note
• https://bdu.fstec.ru/vul/2015-04801 · Security Note
• https://osv.dev/vulnerability/CVE-2004-0782 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:214 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0782 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101776-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-466.html · Vendor Advisory
• http://debian.org/security/2004/dsa-546 · Vendor Advisory