Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allows remote attackers to cause a denial of service (crash) via a large image file, which triggers a large memory allocation.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - gtk2, gtk3: Integer overflow in image handling (CVE-2013-7447)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - gtk2, gtk3: Integer overflow in image handling (CVE-2013-7447)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gdk-pixbuf: DoS (GLib error and application abort) due to an integer overflow in the XBM image file format     loader (CVE-2012-2370)

  - gtk2, gtk3: Integer overflow in image handling (CVE-2013-7447)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for gtk2 fixes the following issues :

  - CVE-2013-7447: Avoid an overflow when allocating a cairo     pixbuf (bsc#966682).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gtk2 fixes the following security issues :

  - CVE-2016-6352: Some crashes were fixed, including a out     of bounds write in the OneLine32() function that could     be used by attackers to crash GTK/GDK programs.

  - CVE-2013-7447: Avoid overflow when allocating a cairo     pixbuf (bsc#966682).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This gtk2 update to version 2.24.31 fixes the following issues :

Security issues fixed :

  - CVE-2013-7447: Fixed integer overflow in image handling     (boo#966682).

Bugs fixed :

  - Changes from version 2.24.31 :

  + Backport many file chooser entry fixes and cleanups.

  + Don't crash if invisible files are deleted.

  + Bugs fixed: bgo#555087, bgo#586367, bgo#635287,     bgo#640698, bgo#648419, bgo#672271, bgo#679333,     bgo#687196, bgo#703220 (CVE-2013-7447), bgo#720330,     bgo#729927, bgo#737777, bgo#752707, bgo#756450,     bgo#765120, bgo#765193, bgo#768163, bgo#764996,     bgo#769126.

GTK2 Engine and branding packages were rebuilt to match the updated gtk2 package (boo#999375).

This gtk2 update to version 2.24.31 fixes the following issues :

Security issues fixed :

  - CVE-2013-7447: Fixed integer overflow in image handling     (boo#966682).

Bugs fixed :

  - Changes from version 2.24.31 :

  + Backport many file chooser entry fixes and cleanups.

  + Don't crash if invisible files are deleted.

  + Bugs fixed: bgo#555087, bgo#586367, bgo#635287,     bgo#640698, bgo#648419, bgo#672271, bgo#679333,     bgo#687196, bgo#703220 (CVE-2013-7447), bgo#720330,     bgo#729927, bgo#737777, bgo#752707, bgo#756450,     bgo#765120, bgo#765193, bgo#768163, bgo#764996,     bgo#769126.

  - Changes from version 2.24.30 :

  + Win32: Build fixes.

  + X11: Support Randr 1.5 monitor information.

  + Bugs fixed: bgo#722815, bgo#612611, bgo#699652,     bgo#698652, bgo#758893.

  + Updated translations.

  - Changes from version 2.24.29 :

  + OS X: Partial aspect ratio support.

  + Bugs fixed: bgo#345345, bgo#745127, bgo#749507,     bgo#752638, bgo#753644, bgo#753691, bgo#753992,     bgo#754046.

  + Updated translations.

GTK2 Engine and branding packages were rebuilt to match the updated gtk2 package (boo#999375).

New gtk+2 packages are available for Slackware 14.1, 14.2, and
-current to fix a security issue.

This update for eog fixes the following issues :

  - Update to version 3.14.5 (CVE-2013-7447 boo#966682) :

  + bgo#762028, >=eog-3.16 is affected by CVE-2013-7447.

  + Updated translations.

Gtk+2.0, a graphical user interface library, was susceptible to an integer overflow in its gdk_cairo_set_source_pixbuf function when allocating a large block of memory.

For Debian 6 'Squeeze', this issue has been fixed in gtk+2.0 version 2.20.1-2+deb6u1. We recommend you to upgrade your gtk+2.0 packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2898-2 advisory.

    It was discovered that Eye of GNOME incorrectly handled certain large images. If a user were tricked into     opening a specially-crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash,     resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2898-1 advisory.

    It was discovered that GTK+ incorrectly handled certain large images. A remote attacker could use this     issue to cause GTK+ applications to crash, resulting in a denial of service, or possibly execute arbitrary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199748	RHEL 5 : gtk2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199745	RHEL 7 : gtk2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199722	RHEL 6 : gtk2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
94270	SUSE SLED12 / SLES12 Security Update : gtk2 (SUSE-SU-2016:2550-1)	Nessus	SuSE Local Security Checks	medium
94268	SUSE SLES11 Security Update : gtk2 (SUSE-SU-2016:2532-1)	Nessus	SuSE Local Security Checks	high
93704	openSUSE Security Update : gtk2 (openSUSE-2016-1118)	Nessus	SuSE Local Security Checks	medium
93703	openSUSE Security Update : gtk2 (openSUSE-2016-1117)	Nessus	SuSE Local Security Checks	medium
93412	Slackware 14.1 / 14.2 / current : gtk+2 (SSA:2016-254-02)	Nessus	Slackware Local Security Checks	medium
89653	openSUSE Security Update : eog (openSUSE-2016-296)	Nessus	SuSE Local Security Checks	medium
88810	Debian DLA-419-1 : gtk+2.0 security update	Nessus	Debian Local Security Checks	medium
88750	Ubuntu 14.04 LTS : Eye of GNOME vulnerability (USN-2898-2)	Nessus	Ubuntu Local Security Checks	medium
88749	Ubuntu 14.04 LTS : GTK+ vulnerability (USN-2898-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-7447

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium