2024-04-22
ALT-BU-2024-6925-2
Branch sisyphus update bulletin.
Package libgdk-pixbuf updated to version 2.42.11-alt1 for branch sisyphus in task 345586.
Closed vulnerabilities
Published: 2024-09-04
Modified: 2026-02-17
Modified: 2026-02-17
BDU:2024-06670
Уязвимость функции ani_load_chunk() библиотеки загрузки изображений GdkPixbuf, позволяющая нарушителю выполнить произвольный код
Severity: HIGH (7.8)Vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH (7.2)Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2024-01-26
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-48622
In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.
Severity: HIGH (7.8)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References: