GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.

An update of the gdk package has been released.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-755ba8968a advisory.

  - GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the     function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11     to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the     value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling     this function with a GIF image with LZW compression that is crafted in a special way. (CVE-2020-29385)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-2e59756cbe advisory.

  - GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the     function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11     to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the     value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling     this function with a GIF image with LZW compression that is crafted in a special way. (CVE-2020-29385)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for gdk-pixbuf fixes the following issues :

  - CVE-2020-29385: Fixed an infinite loop in lzw.c in the     function write_indexes (bsc#1180393).

  - Fixed an integer underflow in the GIF loader     (bsc#1174307).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for gdk-pixbuf fixes the following issues :

CVE-2020-29385: Fixed an infinite loop in lzw.c in the function write_indexes (bsc#1180393).

Fixed an integer underflow in the GIF loader (bsc#1174307).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202012-15 (GDK-PixBuf: Denial of service)

    It was discovered that the GDK-PixBuf library did not properly handle       certain GIF images.
  Impact :

    A remote attacker could entice a user to open a specially crafted GIF       image in an application linked against GDK-PixBuf library, possibly       resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4663-1 advisory.

    Melvin Kool discovered that the GDK-PixBuf library did not properly handle certain GIF images. If an user     or automated system were tricked into opening a specially crafted GIF file, a remote attacker could use     this flaw to cause GDK-PixBuf to hang, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204260	Photon OS 5.0: Gdk PHSA-2023-5.0-0141	Nessus	PhotonOS Local Security Checks	medium
204160	Photon OS 4.0: Gdk PHSA-2023-4.0-0506	Nessus	PhotonOS Local Security Checks	high
147770	Fedora 33 : mingw-gdk-pixbuf (2021-755ba8968a)	Nessus	Fedora Local Security Checks	high
146746	Fedora 33 : gdk-pixbuf2 / gdk-pixbuf2-xlib (2021-2e59756cbe)	Nessus	Fedora Local Security Checks	high
145273	openSUSE Security Update : gdk-pixbuf (openSUSE-2021-150)	Nessus	SuSE Local Security Checks	medium
145258	SUSE SLED15 / SLES15 Security Update : gdk-pixbuf (SUSE-SU-2021:0184-1)	Nessus	SuSE Local Security Checks	medium
144593	GLSA-202012-15 : GDK-PixBuf: Denial of service	Nessus	Gentoo Local Security Checks	medium
143585	Ubuntu 20.04 LTS : GDK-PixBuf vulnerability (USN-4663-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2020-29385

medium

Tenable Plugins

medium

high

high

high

medium

medium

medium

medium