PT-2018-5197 · Gnome+3 · Gdk-Pixbuf+3

Jun · Published 2017-08-21 · Updated 2019-05-02 · CVE-2017-1000422

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gnome gdk-pixbuf versions 2.36.8 and older

Description The issue is related to several integer overflows in the gif get lzw function, which can result in memory corruption and potentially allow code execution.

Recommendations For versions 2.36.8 and older, update to a newer version to mitigate the risk of exploitation. At the moment, there is no information about a specific newer version that contains a fix for this issue.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2017-2087

CVE-2017-1000422

DLA-1234-1

DSA-4088-1

MGASA-2018-0087

MGASA-2018-0090

OPENSUSE-SU-2018_2013-1

SUSE-SU-2018:1950-1

SUSE-SU-2018_1950-1

USN-3532-1

Affected Products

Alt Linux

Suse

Ubuntu

Gdk-Pixbuf

References · 46

• https://ubuntu.com/security/CVE-2017-6312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000422 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0090 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-1000422 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6314 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-1000422 · Security Note
• https://osv.dev/vulnerability/DSA-4088-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4088 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1950-1 · Vendor Advisory
• https://usn.ubuntu.com/3532-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6313 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000422 · Vendor Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=785973 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-1000422 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0090.html · Security Note