An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.

According to the versions of the gdk-pixbuf2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - gdk-pixbuf is an image loading library that can be     extended by loadable modules for new image formats. It     is used by toolkits such as GTK+ or clutter. Security     Fix(es):The make_available_at_least function in     io-tiff.c in gdk-pixbuf allows context-dependent     attackers to cause a denial of service (infinite loop)     via a large TIFF file.(CVE-2017-6314)Integer underflow     in the load_resources function in io-icns.c in     gdk-pixbuf allows context-dependent attackers to cause     a denial of service (out-of-bounds read and program     crash) via a crafted image entry size in an ICO     file.(CVE-2017-6313)An out-of-bounds read flaw was     found in the way GdkPixbuf handled ICO format files. A     maliciously crafted ICO file could cause the     application using GdkPixbuf to crash.(CVE-2017-6312)An     exploitable integer overflow vulnerability exists in     the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6     when compiled with Clang. A specially crafted tiff file     can cause a heap-overflow resulting in remote code     execution. An attacker can send a file or a URL to     trigger this vulnerability.(CVE-2017-2870)An     exploitable heap overflow vulnerability exists in the     gdk_pixbuf__jpeg_image_load_increment functionality of     Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can     cause a heap overflow resulting in remote code     execution. An attacker can send a file or url to     trigger this vulnerability.(CVE-2017-2862)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3140 advisory.

  - freetype: a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c leading to crash     (CVE-2015-9381)

  - freetype: mishandling ps_parser_skip_PS_token in an FT_New_Memory_Face operation in skip_comment,     psaux/psobjs.c, leads to a buffer over-read (CVE-2015-9382)

  - gdk-pixbuf2: Heap overflow in the gdk_pixbuf__jpeg_image_load_increment function (CVE-2017-2862)

  - poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of service     (CVE-2017-18267)

  - webkitgtk: memory corruption processing maliciously crafted web content (CVE-2018-4121, CVE-2018-4200,     CVE-2018-4204)

  - libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c (CVE-2018-10733)

  - libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c     (CVE-2018-10767)

  - poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service via     crafted PDF (CVE-2018-10768)

  - webkitgtk: Improper TLS certificate verification for WebSocket connections (CVE-2018-11712)

  - webkitgtk: WebSockets don't use system proxy settings (CVE-2018-11713)

  - libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

  - poppler: out of bounds read in pdfunite (CVE-2018-13988)

  - accountsservice: insufficient path check in user_change_icon_file_authorized_cb() in user.c     (CVE-2018-14036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for gtk2 provides the following fixes: These security issues were fixed :

  - CVE-2017-6312: Prevent integer overflow that allowed     context-dependent attackers to cause a denial of service     (segmentation fault and application crash) via a crafted     image entry offset in an ICO file (bsc#1027026).

  - CVE-2017-6314: The make_available_at_least function     allowed context-dependent attackers to cause a denial of     service (infinite loop) via a large TIFF file     (bsc#1027025).

  - CVE-2017-6313: Prevent integer underflow in the     load_resources function that allowed context-dependent     attackers to cause a denial of service (out-of-bounds     read and program crash) via a crafted image entry size     in an ICO file (bsc#1027024).

  - CVE-2017-2862: Prevent heap overflow in the     gdk_pixbuf__jpeg_image_load_increment function. A     specially crafted jpeg file could have caused a heap     overflow resulting in remote code execution     (bsc#1048289)

  - CVE-2017-2870: Prevent integer overflow in the     tiff_image_parse functionality. A specially crafted tiff     file could have caused a heap-overflow resulting in     remote code execution (bsc#1048544).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An exploitable heap overflow vulnerability exists in     the gdk_pixbuf__jpeg_image_load_increment functionality     of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can     cause a heap overflow resulting in remote code     execution. An attacker can send a file or url to     trigger this vulnerability.i1/4^CVE-2017-2862i1/4%0

  - An exploitable integer overflow vulnerability exists in     the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6     when compiled with Clang. A specially crafted tiff file     can cause a heap-overflow resulting in remote code     execution. An attacker can send a file or a URL to     trigger this vulnerability.i1/4^CVE-2017-2870i1/4%0

  - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to     several integer overflow in the gif_get_lzw function     resulting in memory corruption and potential code     executioni1/4^CVE-2017-1000422i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - gdk-pixbuf is an image loading library that can be     extended by loadable modules for new image formats. It     is used by toolkits such as GTK+ or clutter.Security     Fix(es):An exploitable heap overflow vulnerability     exists in the gdk_pixbuf__jpeg_image_load_increment     functionality of Gdk-Pixbuf 2.36.6. A specially crafted     jpeg file can cause a heap overflow resulting in remote     code execution. An attacker can send a file or url to     trigger this vulnerability.(CVE-2017-2862)An     exploitable integer overflow vulnerability exists in     the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6     when compiled with Clang. A specially crafted tiff file     can cause a heap-overflow resulting in remote code     execution. An attacker can send a file or a URL to     trigger this vulnerability.(CVE-2017-2870)Gnome     gdk-pixbuf 2.36.8 and older is vulnerable to several     integer overflow in the gif_get_lzw function resulting     in memory corruption and potential code     execution.(CVE-2017-1000422)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marcin Noga discovered a buffer overflow in the JPEG loader of the GDK Pixbuf library, which may result in the execution of arbitrary code if a malformed file is opened.

For Debian 7 'Wheezy', these problems have been fixed in version 2.26.1-1+deb7u6.

We recommend that you upgrade your gdk-pixbuf packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the GDK-PixBuf library did not properly handle certain jpeg images. If an user or automated system were tricked into opening a specially crafted jpeg file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-2862)

It was discovered that the GDK-PixBuf library did not properly handle certain tiff images. If an user or automated system were tricked into opening a specially crafted tiff file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-2870)

Ariel Zelivansky discovered that the GDK-PixBuf library did not properly handle printing certain error messages. If an user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in a denial of service. (CVE-2017-6311).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marcin Noga discovered a buffer overflow in the JPEG loader of the GDK Pixbuf library, which may result in the execution of arbitrary code if a malformed file is opened.

This update for gdk-pixbuf fixes the following issues :

  - CVE-2017-2862: JPEG     gdk_pixbuf__jpeg_image_load_increment Code Execution     Vulnerability (bsc#1048289)

  - CVE-2017-2870: tiff_image_parse Code Execution     Vulnerability (bsc#1048544)

  - CVE-2017-6313: A dangerous integer underflow in     io-icns.c (bsc#1027024)

  - CVE-2017-6314: Infinite loop in io-tiff.c (bsc#1027025)

  - CVE-2017-6312: Out-of-bounds read on io-ico.c     (bsc#1027026)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for gdk-pixbuf fixes the following issues :

  - CVE-2017-2862: JPEG     gdk_pixbuf__jpeg_image_load_increment Code Execution     Vulnerability (bsc#1048289)

  - CVE-2017-2870: tiff_image_parse Code Execution     Vulnerability (bsc#1048544)

  - CVE-2017-6313: A dangerous integer underflow in     io-icns.c (bsc#1027024)

  - CVE-2017-6314: Infinite loop in io-tiff.c (bsc#1027025)

  - CVE-2017-6312: Out-of-bounds read on io-ico.c     (bsc#1027026)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

TALOS reports :

- An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality.

- An exploitable heap-overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality.

ID	Name	Product	Family	Severity
151300	EulerOS Virtualization for ARM 64 3.0.2.0 : gdk-pixbuf2 (EulerOS-SA-2021-2111)	Nessus	Huawei Local Security Checks	high
118726	RHEL 7 : GNOME (RHSA-2018:3140)	Nessus	Red Hat Local Security Checks	critical
112057	SUSE SLES11 Security Update : gtk2 (SUSE-SU-2018:2470-1)	Nessus	SuSE Local Security Checks	high
106774	EulerOS 2.0 SP2 : gdk-pixbuf2 (EulerOS-SA-2018-1046)	Nessus	Huawei Local Security Checks	high
106773	EulerOS 2.0 SP1 : gdk-pixbuf2 (EulerOS-SA-2018-1045)	Nessus	Huawei Local Security Checks	high
103330	Debian DLA-1100-1 : gdk-pixbuf security update	Nessus	Debian Local Security Checks	high
103320	Ubuntu 14.04 LTS / 16.04 LTS : GDK-PixBuf vulnerabilities (USN-3418-1)	Nessus	Ubuntu Local Security Checks	high
103312	Debian DSA-3978-1 : gdk-pixbuf - security update	Nessus	Debian Local Security Checks	high
103160	openSUSE Security Update : gdk-pixbuf (openSUSE-2017-1024)	Nessus	SuSE Local Security Checks	high
102990	SUSE SLED12 / SLES12 Security Update : gdk-pixbuf (SUSE-SU-2017:2381-1)	Nessus	SuSE Local Security Checks	high
102939	FreeBSD : gdk-pixbuf -- multiple vulnerabilities (5a1f1a86-8f4c-11e7-b5af-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-2862

high

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high