The gdk_pixbuf__gif_image_load function in gdk-pixbuf/io-gif.c in gdk-pixbuf before 2.23.5 does not properly handle certain return values, which allows remote attackers to cause a denial of service (memory consumption) via a crafted GIF image file.

The following issue has been fixed :

  - Specially crafted GIF and XBM files could have crashed     gtk2 (CVE-2012-2370 / CVE-2011-2485)

This update of gdk-pixbuf fixes multiple buffer overflows that could have caused a crash or potentially have allowed heap corruptions.
(CVE-2011-2485 / CVE-2012-2370 / CVE-2011-2897)

The following issue has been fixed :

  - Specially crafted GIF and XBM files could have crashed     gtk2. (CVE-2012-2370 / CVE-2011-2485)

The remote host is affected by the vulnerability described in GLSA-201206-20 (gdk-pixbuf: Denial of Service)

    Two vulnerabilities have been found in gdk-pixbuf:
      The 'gdk_pixbuf__gif_image_load()' function in io-gif.c fails to         properly handle certain return values from subroutines (CVE-2011-2485).
      The 'read_bitmap_file_data()' function in io-xbm.c contains an         integer overflow error (CVE-2012-2370).
  Impact :

    A remote attacker could entice a user to open a specially crafted image       in an application linked against gdk-pixbuf, possibly resulting in Denial       of Service.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201206-11 (Pidgin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pidgin. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities allow for arbitrary file retrieval, Denial of       Service and arbitrary code execution with the privileges of the user       running Pidgin.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been identified and fixed in pidgin :

It was found that the gdk-pixbuf GIF image loader routine gdk_pixbuf__gif_image_load() did not properly handle certain return values from its subroutines. A remote attacker could provide a specially crafted GIF image, which, once opened in Pidgin, would lead gdk-pixbuf to return a partially initialized pixbuf structure. Using this structure, possibly containing a huge width and height, could lead to the application being terminated due to excessive memory use (CVE-2011-2485).

Certain characters in the nicknames of IRC users can trigger a NULL pointer dereference in the IRC protocol plugin's handling of responses to WHO requests. This can cause a crash on some operating systems.
Clients based on libpurple 2.8.0 through 2.9.0 are affected (CVE-2011-2943).

Incorrect handling of HTTP 100 responses in the MSN protocol plugin can cause the application to attempt to access memory that it does not have access to. This only affects users who have turned on the HTTP connection method for their accounts (it's off by default). This might only be triggerable by a malicious server and not a malicious peer. We believe remote code execution is not possible (CVE-2011-3184).

This update provides pidgin 2.10.0, which is not vulnerable to these issues.

New pidgin packages are available for Slackware 12.2, 13.0, 13.1, 13.37, and -current to fix a security issue.

The version of Pidgin installed on the remote host is earlier than 2.9.0.  As such, it is potentially affected by a denial of service vulnerability. 

The function 'gdk_pixbuf__gif_image_load' contains an error that allows a crafted GIF image file, when used as a buddy image, to cause memory exhaustion and finally process termination.

ID	Name	Product	Family	Severity
64153	SuSE 11.1 / 11.2 Security Update : gtk2 (SAT Patch Numbers 6389 / 6390)	Nessus	SuSE Local Security Checks	medium
64145	SuSE 11.1 Security Update : gdk-pixbuf (SAT Patch Number 6367)	Nessus	SuSE Local Security Checks	medium
59855	SuSE 10 Security Update : gtk2 (ZYPP Patch Number 8174)	Nessus	SuSE Local Security Checks	medium
59854	SuSE 10 Security Update : gdk-pixbuf (ZYPP Patch Number 8158)	Nessus	SuSE Local Security Checks	medium
59673	GLSA-201206-20 : gdk-pixbuf: Denial of Service	Nessus	Gentoo Local Security Checks	medium
59649	GLSA-201206-11 : Pidgin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
56109	Mandriva Linux Security Advisory : pidgin (MDVSA-2011:132-1)	Nessus	Mandriva Local Security Checks	medium
55703	Slackware 12.2 / 13.0 / 13.1 / 13.37 / current : pidgin (SSA:2011-178-01)	Nessus	Slackware Local Security Checks	medium
55436	Pidgin < 2.9.0 gdk_pixbuf__gif_image_load() Denial of Service	Nessus	Windows	medium

Detections

Analytics

CVE-2011-2485

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium