GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the gdk-pixbuf2-2.42.6-3.el9 build changelog.

  - GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw     compressed stream of image data in GIF files with lzw minimum code size equals to 12. (CVE-2021-44648)

  - GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or     clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is     controllable and could be abused for code execution, especially on 32-bit systems. (CVE-2021-46829)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-352 advisory.

  - GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw     compressed stream of image data in GIF files with lzw minimum code size equals to 12. (CVE-2021-44648)

  - GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or     clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is     controllable and could be abused for code execution, especially on 32-bit systems. (CVE-2021-46829)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2216 advisory.

  - GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or     clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is     controllable and could be abused for code execution, especially on 32-bit systems. (CVE-2021-46829)

  - GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw     compressed stream of image data in GIF files with lzw minimum code size equals to 12. (CVE-2021-44648)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2216 advisory.

  - GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw     compressed stream of image data in GIF files with lzw minimum code size equals to 12. (CVE-2021-44648)

  - GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or     clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is     controllable and could be abused for code execution, especially on 32-bit systems. (CVE-2021-46829)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2216 advisory.

  - gdk-pixbuf: heap-buffer overflow when decoding the lzw compressed stream of image data (CVE-2021-44648)

  - gdk-pixbuf: heap-based buffer overflow when compositing or clearing frames in GIF files (CVE-2021-46829)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5607-1 advisory.

  - GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw     compressed stream of image data in GIF files with lzw minimum code size equals to 12. (CVE-2021-44648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5228 advisory.

  - GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw     compressed stream of image data in GIF files with lzw minimum code size equals to 12. (CVE-2021-44648)

  - GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or     clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is     controllable and could be abused for code execution, especially on 32-bit systems. (CVE-2021-46829)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3230-1 advisory.

  - GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw     compressed stream of image data in GIF files with lzw minimum code size equals to 12. (CVE-2021-44648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3153-1 advisory.

  - GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw     compressed stream of image data in GIF files with lzw minimum code size equals to 12. (CVE-2021-44648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191210	CentOS 9 : gdk-pixbuf2-2.42.6-3.el9	Nessus	CentOS Local Security Checks	high
181698	Amazon Linux 2023 : gdk-pixbuf2, gdk-pixbuf2-devel, gdk-pixbuf2-modules (ALAS2023-2023-352)	Nessus	Amazon Linux Local Security Checks	high
175720	Oracle Linux 9 : gdk-pixbuf2 (ELSA-2023-2216)	Nessus	Oracle Linux Local Security Checks	high
175636	AlmaLinux 9 : gdk-pixbuf2 (ALSA-2023:2216)	Nessus	Alma Linux Local Security Checks	high
175444	RHEL 9 : gdk-pixbuf2 (RHSA-2023:2216)	Nessus	Red Hat Local Security Checks	high
165011	Ubuntu 20.04 LTS / 22.04 LTS : GDK-PixBuf vulnerability (USN-5607-1)	Nessus	Ubuntu Local Security Checks	high
164943	Debian DSA-5228-1 : gdk-pixbuf - security update	Nessus	Debian Local Security Checks	high
164937	SUSE SLED15 / SLES15 Security Update : gdk-pixbuf (SUSE-SU-2022:3230-1)	Nessus	SuSE Local Security Checks	high
164880	SUSE SLED15 / SLES15 Security Update : gdk-pixbuf (SUSE-SU-2022:3153-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-44648

high

Tenable Plugins

high

high

high

high

high

high

high

high

high