Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | GDK vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-216-1 | First vendor Publication | 2005-11-16 |
| Vendor | Ubuntu | Last vendor Modification | 2005-11-16 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.8 | Attack Range | Network |
| Cvss Impact Score | 6.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger) The following packages are affected: gtk2-engines-pixbuf libgdk-pixbuf2 The problem can be corrected by upgrading the affected package to the following versions: Ubuntu 4.10: Ubuntu 5.04: Ubuntu 5.10: After a standard system upgrade you should restart your session to effect the necessary changes. Details follow: Two integer overflows have been discovered in the XPM image loader of the GDK pixbuf library. By tricking an user into opening a specially crafted XPM image with any Gnome desktop application that uses this library, this could be exploited to execute arbitrary code with the privileges of the user running the application. (CVE-2005-2976, CVE-2005-3186) Additionally, specially crafted XPM images could cause an endless loop in the image loader, which could be exploited to cause applications trying to open that image to hang. (CVE-2005-2975) |
Original Source
| Url : http://www.ubuntu.com/usn/USN-216-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-399 | Resource Management Errors |
| 50 % | CWE-190 | Integer Overflow or Wraparound (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11370 | |||
| Oval ID: | oval:org.mitre.oval:def:11370 | ||
| Title: | Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbitrary code via an XPM file with large height, width, and colour values, a different vulnerability than CVE-2005-3186. | ||
| Description: | Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbitrary code via an XPM file with large height, width, and colour values, a different vulnerability than CVE-2005-3186. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-2976 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9503 | |||
| Oval ID: | oval:org.mitre.oval:def:9503 | ||
| Title: | Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow. | ||
| Description: | Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-3186 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9697 | |||
| Oval ID: | oval:org.mitre.oval:def:9697 | ||
| Title: | io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before 2.8.7 allows attackers to cause a denial of service (infinite loop) via a crafted XPM image with a large number of colors. | ||
| Description: | io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before 2.8.7 allows attackers to cause a denial of service (infinite loop) via a crafted XPM image with a large number of colors. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-2975 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 | |
| Application | 7 | |
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for gdk-pixbuf File : nvt/sles9p5018289.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200511-14 (gtk+) File : nvt/glsa_200511_14.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 911-1 (gtk+2.0) File : nvt/deb_911_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 913-1 (gdk-pixbuf) File : nvt/deb_913_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 20842 | GTK+ GdkPixbuf XPM Image Processing Multiple Field Overflow |
| 20841 | GTK+ GdkPixbuf XPM Image Processing Large Color Value DoS |
| 20840 | GTK+ GdkPixbuf XPM Image Processing Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_10558.nasl - Type : ACT_GATHER_INFO |
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-911.nasl - Type : ACT_GATHER_INFO |
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-913.nasl - Type : ACT_GATHER_INFO |
| 2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-810.nasl - Type : ACT_GATHER_INFO |
| 2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-811.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-214.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-216-1.nasl - Type : ACT_GATHER_INFO |
| 2005-11-21 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-1085.nasl - Type : ACT_GATHER_INFO |
| 2005-11-21 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-1086.nasl - Type : ACT_GATHER_INFO |
| 2005-11-21 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-1087.nasl - Type : ACT_GATHER_INFO |
| 2005-11-21 | Name : The remote Fedora Core host is missing a security update. File : fedora_2005-1088.nasl - Type : ACT_GATHER_INFO |
| 2005-11-21 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200511-14.nasl - Type : ACT_GATHER_INFO |
| 2005-11-21 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-810.nasl - Type : ACT_GATHER_INFO |
| 2005-11-21 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-811.nasl - Type : ACT_GATHER_INFO |
| 2005-11-21 | Name : The remote host is missing a vendor-supplied security patch. File : suse_SA_2005_065.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:07 |
|
