An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gdk-pixbuf2: Integer overflow in tiff_image_parse function (CVE-2017-2870)

  - The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial     of service (out-of-bounds write and crash) via crafted dimensions in an ICO file. (CVE-2016-6352)

  - An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment     functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in     remote code execution. An attacker can send a file or url to trigger this vulnerability. (CVE-2017-2862)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the gdk-pixbuf2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - gdk-pixbuf is an image loading library that can be     extended by loadable modules for new image formats. It     is used by toolkits such as GTK+ or clutter. Security     Fix(es):The make_available_at_least function in     io-tiff.c in gdk-pixbuf allows context-dependent     attackers to cause a denial of service (infinite loop)     via a large TIFF file.(CVE-2017-6314)Integer underflow     in the load_resources function in io-icns.c in     gdk-pixbuf allows context-dependent attackers to cause     a denial of service (out-of-bounds read and program     crash) via a crafted image entry size in an ICO     file.(CVE-2017-6313)An out-of-bounds read flaw was     found in the way GdkPixbuf handled ICO format files. A     maliciously crafted ICO file could cause the     application using GdkPixbuf to crash.(CVE-2017-6312)An     exploitable integer overflow vulnerability exists in     the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6     when compiled with Clang. A specially crafted tiff file     can cause a heap-overflow resulting in remote code     execution. An attacker can send a file or a URL to     trigger this vulnerability.(CVE-2017-2870)An     exploitable heap overflow vulnerability exists in the     gdk_pixbuf__jpeg_image_load_increment functionality of     Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can     cause a heap overflow resulting in remote code     execution. An attacker can send a file or url to     trigger this vulnerability.(CVE-2017-2862)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3140 advisory.

    GNOME is the default desktop environment of Red Hat Enterprise Linux.

    Security Fix(es):

    * libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

    * poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of     service (CVE-2017-18267)

    * libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c (CVE-2018-10733)

    * libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c     (CVE-2018-10767)

    * poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service     via crafted PDF (CVE-2018-10768)

    * poppler: out of bounds read in pdfunite (CVE-2018-13988)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank chenyuan (NESA Lab) for reporting CVE-2018-10733 and CVE-2018-10767 and Hosein     Askari for reporting CVE-2018-13988.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for gtk2 provides the following fixes: These security issues were fixed :

  - CVE-2017-6312: Prevent integer overflow that allowed     context-dependent attackers to cause a denial of service     (segmentation fault and application crash) via a crafted     image entry offset in an ICO file (bsc#1027026).

  - CVE-2017-6314: The make_available_at_least function     allowed context-dependent attackers to cause a denial of     service (infinite loop) via a large TIFF file     (bsc#1027025).

  - CVE-2017-6313: Prevent integer underflow in the     load_resources function that allowed context-dependent     attackers to cause a denial of service (out-of-bounds     read and program crash) via a crafted image entry size     in an ICO file (bsc#1027024).

  - CVE-2017-2862: Prevent heap overflow in the     gdk_pixbuf__jpeg_image_load_increment function. A     specially crafted jpeg file could have caused a heap     overflow resulting in remote code execution     (bsc#1048289)

  - CVE-2017-2870: Prevent integer overflow in the     tiff_image_parse functionality. A specially crafted tiff     file could have caused a heap-overflow resulting in     remote code execution (bsc#1048544).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An exploitable heap overflow vulnerability exists in     the gdk_pixbuf__jpeg_image_load_increment functionality     of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can     cause a heap overflow resulting in remote code     execution. An attacker can send a file or url to     trigger this vulnerability.i1/4^CVE-2017-2862i1/4%0

  - An exploitable integer overflow vulnerability exists in     the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6     when compiled with Clang. A specially crafted tiff file     can cause a heap-overflow resulting in remote code     execution. An attacker can send a file or a URL to     trigger this vulnerability.i1/4^CVE-2017-2870i1/4%0

  - Gnome gdk-pixbuf 2.36.8 and older is vulnerable to     several integer overflow in the gif_get_lzw function     resulting in memory corruption and potential code     executioni1/4^CVE-2017-1000422i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - gdk-pixbuf is an image loading library that can be     extended by loadable modules for new image formats. It     is used by toolkits such as GTK+ or clutter.Security     Fix(es):An exploitable heap overflow vulnerability     exists in the gdk_pixbuf__jpeg_image_load_increment     functionality of Gdk-Pixbuf 2.36.6. A specially crafted     jpeg file can cause a heap overflow resulting in remote     code execution. An attacker can send a file or url to     trigger this vulnerability.(CVE-2017-2862)An     exploitable integer overflow vulnerability exists in     the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6     when compiled with Clang. A specially crafted tiff file     can cause a heap-overflow resulting in remote code     execution. An attacker can send a file or a URL to     trigger this vulnerability.(CVE-2017-2870)Gnome     gdk-pixbuf 2.36.8 and older is vulnerable to several     integer overflow in the gif_get_lzw function resulting     in memory corruption and potential code     execution.(CVE-2017-1000422)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marcin Noga discovered a buffer overflow in the JPEG loader of the GDK Pixbuf library, which may result in the execution of arbitrary code if a malformed file is opened.

For Debian 7 'Wheezy', these problems have been fixed in version 2.26.1-1+deb7u6.

We recommend that you upgrade your gdk-pixbuf packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3418-1 advisory.

    It was discovered that the GDK-PixBuf library did not properly handle certain jpeg images. If an user or     automated system were tricked into opening a specially crafted jpeg file, a remote attacker could use this     flaw to cause GDK-PixBuf to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2017-2862)

    It was discovered that the GDK-PixBuf library did not properly handle certain tiff images. If an user or     automated system were tricked into opening a specially crafted tiff file, a remote attacker could use this     flaw to cause GDK-PixBuf to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2017-2870)

    Ariel Zelivansky discovered that the GDK-PixBuf library did not properly handle printing certain error     messages. If an user or automated system were tricked into opening a specially crafted image file, a     remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in a denial of service.
    (CVE-2017-6311)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Marcin Noga discovered a buffer overflow in the JPEG loader of the GDK Pixbuf library, which may result in the execution of arbitrary code if a malformed file is opened.

This update for gdk-pixbuf fixes the following issues :

  - CVE-2017-2862: JPEG     gdk_pixbuf__jpeg_image_load_increment Code Execution     Vulnerability (bsc#1048289)

  - CVE-2017-2870: tiff_image_parse Code Execution     Vulnerability (bsc#1048544)

  - CVE-2017-6313: A dangerous integer underflow in     io-icns.c (bsc#1027024)

  - CVE-2017-6314: Infinite loop in io-tiff.c (bsc#1027025)

  - CVE-2017-6312: Out-of-bounds read on io-ico.c     (bsc#1027026)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for gdk-pixbuf fixes the following issues :

  - CVE-2017-2862: JPEG     gdk_pixbuf__jpeg_image_load_increment Code Execution     Vulnerability (bsc#1048289)

  - CVE-2017-2870: tiff_image_parse Code Execution     Vulnerability (bsc#1048544)

  - CVE-2017-6313: A dangerous integer underflow in     io-icns.c (bsc#1027024)

  - CVE-2017-6314: Infinite loop in io-tiff.c (bsc#1027025)

  - CVE-2017-6312: Out-of-bounds read on io-ico.c     (bsc#1027026)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

TALOS reports :

- An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality.

- An exploitable heap-overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality.

ID	Name	Product	Family	Severity
199216	RHEL 6 : gdk-pixbuf2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195710	RHEL 6 : gdk-pixbuf2 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
151300	EulerOS Virtualization for ARM 64 3.0.2.0 : gdk-pixbuf2 (EulerOS-SA-2021-2111)	Nessus	Huawei Local Security Checks	high
118726	RHEL 7 : GNOME (RHSA-2018:3140)	Nessus	Red Hat Local Security Checks	critical
112057	SUSE SLES11 Security Update : gtk2 (SUSE-SU-2018:2470-1)	Nessus	SuSE Local Security Checks	high
106774	EulerOS 2.0 SP2 : gdk-pixbuf2 (EulerOS-SA-2018-1046)	Nessus	Huawei Local Security Checks	high
106773	EulerOS 2.0 SP1 : gdk-pixbuf2 (EulerOS-SA-2018-1045)	Nessus	Huawei Local Security Checks	high
103330	Debian DLA-1100-1 : gdk-pixbuf security update	Nessus	Debian Local Security Checks	high
103320	Ubuntu 14.04 LTS / 16.04 LTS : GDK-PixBuf vulnerabilities (USN-3418-1)	Nessus	Ubuntu Local Security Checks	high
103312	Debian DSA-3978-1 : gdk-pixbuf - security update	Nessus	Debian Local Security Checks	high
103160	openSUSE Security Update : gdk-pixbuf (openSUSE-2017-1024)	Nessus	SuSE Local Security Checks	high
102990	SUSE SLED12 / SLES12 Security Update : gdk-pixbuf (SUSE-SU-2017:2381-1)	Nessus	SuSE Local Security Checks	high
102939	FreeBSD : gdk-pixbuf -- multiple vulnerabilities (5a1f1a86-8f4c-11e7-b5af-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-2862

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

high

high