RHEL 2.1 / 3 : gdk-pixbuf (RHSA-2004:447)

high Nessus Plugin ID 14738

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated gdk-pixbuf packages that fix several security flaws are now available.

The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment.

[Updated 15th September 2004] Packages have been updated to correct a bug which caused the xpm loader to fail.

During testing of a previously fixed flaw in Qt (CVE-2004-0691), a flaw was discovered in the BMP image processor of gdk-pixbuf. An attacker could create a carefully crafted BMP file which would cause an application to enter an infinite loop and not respond to user input when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0753 to this issue.

During a security audit, Chris Evans discovered a stack and a heap overflow in the XPM image decoder. An attacker could create a carefully crafted XPM file which could cause an application linked with gtk2 to crash or possibly execute arbitrary code when the file was opened by a victim. (CVE-2004-0782, CVE-2004-0783)

Chris Evans also discovered an integer overflow in the ICO image decoder. An attacker could create a carefully crafted ICO file which could cause an application linked with gtk2 to crash when the file is opened by a victim. (CVE-2004-0788)

These packages have also been updated to correct a bug which caused the xpm loader to fail.

Users of gdk-pixbuf are advised to upgrade to these packages, which contain backported patches and are not vulnerable to these issues.

Solution

Update the affected gdk-pixbuf, gdk-pixbuf-devel and / or gdk-pixbuf-gnome packages.

Plugin Details

Severity: High

ID: 14738

File Name: redhat-RHSA-2004-447.nasl

Version: 1.28

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 9/15/2004

Updated: 1/14/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:gdk-pixbuf, cpe:/o:redhat:enterprise_linux:3, p-cpe:/a:redhat:enterprise_linux:gdk-pixbuf-gnome, p-cpe:/a:redhat:enterprise_linux:gdk-pixbuf-devel, cpe:/o:redhat:enterprise_linux:2.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 9/15/2004

Vulnerability Publication Date: 10/20/2004

Reference Information

CVE: CVE-2004-0753, CVE-2004-0782, CVE-2004-0783, CVE-2004-0788

RHSA: 2004:447

Detections

Analytics