Date: Fri, 24 Jun 2011 11:12:02 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org>, Matthias Clasen <mclasen@...hat.com>, Mark Doliner <markdoliner@...gin.im> CC: oss-security@...ts.openwall.com Subject: CVE-2011-2485 assignment notification -- gdk-pixbuf Hello Josh, Steve, vendors, the following security flaw has been found in the way gdk-pixbuf, an image loading library, loaded certain Graphics Interchange Format (GIF) image files: ======================================================================= It was found that gdk-pixbuf's gdk_pixbuf__gif_image_load() GIF image loader routine did not properly handle certain return values from its subroutines. A remote attacker could provide a specially-crafted GIF image, which once opened in an application, linked against gdk-pixbuf would lead to gdk-pixbuf to return partially initialized pixbuf structure, possibly having huge width and height, leading to that particular application termination due excessive memory use. The CVE identifier of CVE-2011-2485 has been assigned to this issue. References:  https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2485  http://git.gnome.org/browse/gdk-pixbuf/commit/?id=f8569bb13e2aa1584dde61ca545144750f7a7c98 This issue could lead (for example) in Pidgin to: ================================================= A remote attacker could set a specially-crafted GIF image as their buddy icon that could lead to Pidgin being terminated due to excessive memory use. References:  https://bugzilla.redhat.com/show_bug.cgi?id=714754  http://www.pidgin.im/news/security/?id=52 Credit: Issue has been discovered and reported by Mark Doliner of the Pidgin project. We did not allocate a second CVE identifier for the Pidgin issue, since the true underlying reason for this was the gdk-pixbuf image loading library problem. This is based on last paragraph from:  http://www.openwall.com/lists/oss-security/2011/03/30/3 more exactly on that part about 'issues like incorrectly reporting error status from an API function' (although this not being case of compiler, but rather case of library). Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.