Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - eog: Out-of-bounds write when passing invalid UTF-8 to GMarkup (CVE-2016-6855)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to the version of the eog packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before     3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used     with glib before 2.44.1, allow remote attackers to     cause a denial of service (out-of-bounds write and     crash) via vectors involving passing invalid UTF-8 to     GMarkup.(CVE-2016-6855)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that eog (Eye of GNOME) incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulting in a denial of service, or possibly execute arbitrary code.

For Debian 8 'Jessie', this problem has been fixed in version 3.14.1-1+deb8u1.

We recommend that you upgrade your eog packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the eog package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before     3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used     with glib before 2.44.1, allow remote attackers to     cause a denial of service (out-of-bounds write and     crash) via vectors involving passing invalid UTF-8 to     GMarkup.(CVE-2016-6855)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for eog fixes the following issues :

  - out-of-bounds write in eog (bsc#994819, CVE-2016-6855)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for eog fixes the following issues :

  - Update to version 3.16.5 (boo#994819, CVE-2016-6855) :

  + Bug fixes :

  - bgo#770143: CVE-2016-6855 out-of-bounds write in eog     3.10.2.

  - bgo#770197: eog leaks error message if loading an SVG     fails.

It was discovered that Eye of GNOME incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulting in a denial of service, or possibly execute arbitrary code.

For Debian 7 'Wheezy', these problems have been fixed in version 3.4.2-1+build1+deb7u1.

We recommend that you upgrade your eog packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Eye of GNOME incorrectly handled certain invalid UTF-8 strings. If a user were tricked into opening a specially crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

eog 3.20.4 release, fixing CVE-2016-6855.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

eog 3.18.3 release, fixing CVE-2016-6855.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Felix Riemann reports :

CVE-2016-6855 out-of-bounds write in eog 3.10.2.

ID	Name	Product	Family	Severity
195365	RHEL 7 : eog (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
142294	EulerOS 2.0 SP2 : eog (EulerOS-SA-2020-2341)	Nessus	Huawei Local Security Checks	high
135977	Debian DLA-2185-1 : eog security update	Nessus	Debian Local Security Checks	high
129219	EulerOS 2.0 SP3 : eog (EulerOS-SA-2019-2026)	Nessus	Huawei Local Security Checks	high
94938	SUSE SLED12 / SLES12 Security Update : eog (SUSE-SU-2016:2827-1)	Nessus	SuSE Local Security Checks	high
93337	openSUSE Security Update : eog (openSUSE-2016-1053)	Nessus	SuSE Local Security Checks	high
93133	Debian DLA-605-1 : eog security update	Nessus	Debian Local Security Checks	high
93120	Ubuntu 14.04 LTS / 16.04 LTS : Eye of GNOME vulnerability (USN-3069-1)	Nessus	Ubuntu Local Security Checks	high
93103	Fedora 24 : eog (2016-5abbc35b6a)	Nessus	Fedora Local Security Checks	high
93101	Fedora 23 : eog (2016-0f8779baa6)	Nessus	Fedora Local Security Checks	high
93073	FreeBSD : eog -- out-of-bounds write (f5035ead-688b-11e6-8b1d-c86000169601)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-6855

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high