EulerOS 2.0 SP2 : gdk-pixbuf2 (EulerOS-SA-2018-1046)

Medium Nessus Plugin ID 106774


The remote EulerOS host is missing multiple security updates.


According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

- An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.(CVE-2017-2862)

- An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.(CVE-2017-2870)

- Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution(CVE-2017-1000422)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Update the affected gdk-pixbuf2 packages.

See Also

Plugin Details

Severity: Medium

ID: 106774

File Name: EulerOS_SA-2018-1046.nasl

Version: 3.10

Type: local

Published: 2018/02/13

Modified: 2018/03/20

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:U/RC:ND


Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:huawei:euleros:gdk-pixbuf2, p-cpe:/a:huawei:euleros:gdk-pixbuf2-devel, cpe:/o:huawei:euleros:2.0

Required KB Items: Host/local_checks_enabled, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2018/02/05

Reference Information

CVE: CVE-2017-1000422, CVE-2017-2862, CVE-2017-2870

OSVDB: 163855, 164333, 171816