Synopsis :

The remote Debian host is missing a security-related update.

Description :

Chris Evans discovered several problems in gdk-pixbuf, the GdkPixBuf
library used in Gtk. It is possible for an attacker to execute
arbitrary code on the victims machine. Gdk-pixbuf for Gtk+1.2 is an
external package. For Gtk+2.0 it's part of the main gtk package.

The Common Vulnerabilities and Exposures Project identifies the
following vulnerabilities :

- CAN-2004-0782
Heap-based overflow in pixbuf_create_from_xpm.

- CAN-2004-0783

Stack-based overflow in xpm_extract_color.

- CAN-2004-0788

Integer overflow in the ico loader.

See also :

http://www.debian.org/security/2004/dsa-549

Solution :

Upgrade the Gtk packages.

For the stable distribution (woody) these problems have been fixed in
version 2.0.2-5woody2.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)