SecurityTracker.com Archives - (Conectiva Issues Fix) gdk-pixbug BMP, ICO, and XPM Image Processing Errors May Let Remote Users Execute Arbitrary Code

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker
Archives

Sign Up

Instant Alerts

Buy our Premium Vulnerability Notification Service to receive customized, instant alerts

Affiliates

Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!

Partners

Become a Partner and License Our Database or Notification Service

Report a Bug

Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com

Category: Application (Generic) > gdk-pixbuf

Vendors: GNU [multiple authors]

(Conectiva Issues Fix) gdk-pixbug BMP, ICO, and XPM Image Processing Errors May Let Remote Users Execute Arbitrary Code

SecurityTracker Alert ID: 1011770

SecurityTracker URL: http://securitytracker.com/id?1011770

CVE Reference: CAN-2004-0753 (Links to External Site)

Date: Oct 18 2004

Impact: Denial of service via network, Execution of arbitrary code via network, User access via network

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 0.22 and prior versions

Description: Several vulnerabilities were reported in gdk-pixbug. A remote user can create a specially crafted image file that, when processed by an application using gdk-pixbug, will cause the application to crash or potentially execute arbitrary code.

Mandrake and Red Hat reported that a remote user can create a specially crafted BMP image file that will cause gdk-pixbug to enter an infinite loop [CVE: CAN-2004-0753].

It is also reported that Chris Evans discovered several overflows. A heap-based overflow and a stack-based overflow reside in the xpm loader [CVE: CAN-2004-0782, CAN-2004-0783]. An integer overflow resides in the ico loader [CVE: CAN-2004-0788]. A remote user may be able to trigger the overflows to cause an application that uses gdk-pixbug to crash or possibly execute arbitrary code.

Impact: A remote user may be able to cause an application using gdk-pixbug to crash or potentially execute arbitrary code with the privileges of the application.

Vendor URL: ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/ (Links to External Site)

Cause: Boundary error, State error

Underlying OS: Linux (Conectiva)

Underlying OS Comments: 9, 10

Reported By: Conectiva Updates <secure@conectiva.com.br>

Message History: This archive entry is a follow-up to the message listed below.

Sep 15 2004

gdk-pixbug BMP, ICO, and XPM Image Processing Errors May Let Remote Users Execute Arbitrary Code

Source Message Contents

Date: Mon, 18 Oct 2004 14:06:18 -0200
From: Conectiva Updates <secure@conectiva.com.br>
Subject: [Conectiva-updates] [CLA-2004:875] Conectiva Security Announcement

 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : gtk+
SUMMARY   : Fixes for image loading vulnerabilities
DATE      : 2004-10-18 14:01:00
ID        : CLA-2004:875
RELEVANT
RELEASES  : 9, 10

- -------------------------------------------------------------------------

DESCRIPTION
 The gdk-pixbuf[1] library is a replacement for imlib with many
 improvements.
 
 A vulnerability found in the gdk-pixbuf bmp loader could allow a
 specially crafted BMP image to hang applications in an infinite loop
 (CAN-2004-0753[2]).
 
 Chris Evans[3] found a heap-based overflow and a stack-based overflow
 on gdk-pixbuf's xpm loader (CAN-2004-0782[4] and CAN-2004-0783[5]).
 
 He also discovered an integer overflow in the ico loader of
 gdk-pixbuf (CAN-2004-0788[6]).


SOLUTION
 It is recommended that all gdk-pixbuf and/or gtk+2 users upgrade
 their packages.
 
 IMPORTANT: all applications linked against gdk-pixbuf or gtk+2 must
 be restarted after the upgrade in order to close the
 vulnerabilities.
 
 
 REFERENCES
 1.http://developer.gnome.org/arch/imaging/gdkpixbuf.html
 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0753
 3.http://scary.beasts.org/security/CESA-2004-005.txt
 4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0782
 5.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0783
 6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0788


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/10/SRPMS/gdk-pixbuf-0.22.0-49324U10_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gdk-pixbuf-0.22.0-49324U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gdk-pixbuf-devel-0.22.0-49324U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gdk-pixbuf-devel-static-0.22.0-49324U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gdk-pixbuf-doc-0.22.0-49324U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/SRPMS/gtk+2-2.4.1-60034U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-devel-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-devel-static-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-doc-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-af-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-am-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ar-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-az-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-be-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-bg-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-bn-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-br-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ca-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-cs-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-cy-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-da-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-de-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-el-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-en_CA-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-en_GB-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-es-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-et-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-eu-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-fa-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-fi-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-fr-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ga-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-gl-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-gu-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-he-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-hi-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-hr-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-hu-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ia-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-id-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-is-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-it-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ja-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ko-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-li-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-lt-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-lv-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-mi-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-mk-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ml-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-mn-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-mr-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ms-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ne-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-nl-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-nn-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-no-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-pa-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-pl-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-pt-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-pt_BR-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ro-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ru-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-sk-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-sl-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-sq-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-sr-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-sv-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-ta-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-th-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-tr-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-uk-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-uz-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-vi-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-wa-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-yi-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-zh_CN-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/gtk+2-i18n-zh_TW-2.4.1-60034U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/gdk-pixbuf-0.22.0-22265U90_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/gdk-pixbuf-0.22.0-22265U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/gdk-pixbuf-devel-0.22.0-22265U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/gdk-pixbuf-devel-static-0.22.0-22265U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/gdk-pixbuf-doc-0.22.0-22265U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/gtk+2-2.2.1-25016U90_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/gtk+2-2.2.1-25016U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/gtk+2-devel-2.2.1-25016U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/gtk+2-doc-2.2.1-25016U90_2cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions regarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQFBc+n542jd0JmAcZARAn/dAKDJnqAbLHi5KUl5EUVGf8jpnN9NLACfUq8g
IRcdFRDw5BettJTdsCPMUIY=
=D21B
-----END PGP SIGNATURE-----

______________________________________________________________________
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br

Go to the Top of This SecurityTracker Archive Page

Home | View Topics | Search | Contact Us | Help
Copyright 2004, SecurityGlobal.net LLC