Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbitrary code via an XPM file with large height, width, and colour values, a different vulnerability than CVE-2005-3186.

This update fixes the following security problem: a heap overflow in the XPM reader allowed attackers to execute arbitrary code via specially crafted XPM images. (CVE-2005-3186, CVE-2005-2975, CVE-2005-2976)

Several vulnerabilities have been found in gdk-pixbuf, the Gtk+ GdkPixBuf XPM image rendering library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-2975     Ludwig Nussel discovered an infinite loop when     processing XPM images that allows an attacker to cause a     denial of service via a specially crafted XPM file.

  - CVE-2005-2976     Ludwig Nussel discovered an integer overflow in the way     XPM images are processed that could lead to the     execution of arbitrary code or crash the application via     a specially crafted XPM file.

  - CVE-2005-3186     'infamous41md' discovered an integer in the XPM     processing routine that can be used to execute arbitrary     code via a traditional heap overflow.

Several vulnerabilities have been found in gtk+2.0, the Gtk+ GdkPixBuf XPM image rendering library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-2975     Ludwig Nussel discovered an infinite loop when     processing XPM images that allows an attacker to cause a     denial of service via a specially crafted XPM file.

  - CVE-2005-2976     Ludwig Nussel discovered an integer overflow in the way     XPM images are processed that could lead to the     execution of arbitrary code or crash the application via     a specially crafted XPM file.

  - CVE-2005-3186     'infamous41md' discovered an integer overflow in the XPM     processing routine that can be used to execute arbitrary     code via a traditional heap overflow.

Updated gdk-pixbuf packages that fix several security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment.

A bug was found in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3186 to this issue.

Ludwig Nussel discovered an integer overflow bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to execute arbitrary code or crash when the file was opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2976 to this issue.

Ludwig Nussel also discovered an infinite-loop denial of service bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to stop responding when the file was opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2975 to this issue.

Users of gdk-pixbuf are advised to upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

Two integer overflows have been discovered in the XPM image loader of the GDK pixbuf library. By tricking an user into opening a specially crafted XPM image with any Gnome desktop application that uses this library, this could be exploited to execute arbitrary code with the privileges of the user running the application. (CVE-2005-2976, CVE-2005-3186)

Additionally, specially crafted XPM images could cause an endless loop in the image loader, which could be exploited to cause applications trying to open that image to hang. (CVE-2005-2975).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap overflow vulnerability in the GTK+ gdk-pixbuf XPM image rendering library could allow for arbitrary code execution. This allows an attacker to provide a carefully crafted XPM image which could possibly allow for arbitrary code execution in the context of the user viewing the image. (CVE-2005-3186)

Ludwig Nussel discovered an integer overflow bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to execute arbitrary code or crash when the file was opened by a victim. (CVE-2005-2976)

Ludwig Nussel also discovered an infinite-loop denial of service bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to stop responding when the file was opened by a victim. (CVE-2005-2975)

The gtk+2.0 library also contains the same gdk-pixbuf code with the same vulnerability.

The Corporate Server 2.1 packages have additional patches to address CVE-2004-0782,0783,0788 (additional XPM/ICO image issues), CVE-2004-0753 (BMP image issues) and CVE-2005-0891 (additional BMP issues). These were overlooked on this platform with earlier updates.

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200511-14 (GTK+ 2, GdkPixbuf: Multiple XPM decoding vulnerabilities)

    iDEFENSE reported a possible heap overflow in the XPM loader     (CVE-2005-3186). Upon further inspection, Ludwig Nussel discovered two     additional issues in the XPM processing functions : an integer overflow     (CVE-2005-2976) that affects only gdk-pixbuf, and an infinite loop     (CVE-2005-2975).
  Impact :

    Using a specially crafted XPM image an attacker could cause an     affected application to enter an infinite loop or trigger the     overflows, potentially allowing the execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
41084	SuSE9 Security Update : gdk-pixbuf (YOU Patch Number 10558)	Nessus	SuSE Local Security Checks	high
22779	Debian DSA-913-1 : gdk-pixbuf - several vulnerabilities	Nessus	Debian Local Security Checks	high
22777	Debian DSA-911-1 : gtk+2.0 - several vulnerabilities	Nessus	Debian Local Security Checks	high
21866	CentOS 3 / 4 : gdk-pixbuf (CESA-2005:810)	Nessus	CentOS Local Security Checks	high
20634	Ubuntu 4.10 / 5.04 / 5.10 : gtk+2.0, gdk-pixbuf vulnerabilities (USN-216-1)	Nessus	Ubuntu Local Security Checks	high
20446	Mandrake Linux Security Advisory : gdk-pixbuf (MDKSA-2005:214)	Nessus	Mandriva Local Security Checks	high
20237	RHEL 2.1 / 3 / 4 : gdk-pixbuf (RHSA-2005:810)	Nessus	Red Hat Local Security Checks	high
20235	GLSA-200511-14 : GTK+ 2, GdkPixbuf: Multiple XPM decoding vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-2976

critical

Tenable Plugins

high

high

high

high

high

high

high

high