Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 24 Jun 2011 11:12:02 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>,
        Matthias Clasen <mclasen@...hat.com>,
        Mark Doliner <markdoliner@...gin.im>
CC: oss-security@...ts.openwall.com
Subject: CVE-2011-2485 assignment notification -- gdk-pixbuf

Hello Josh, Steve, vendors,

   the following security flaw has been found in the way gdk-pixbuf, an
image loading library, loaded certain Graphics Interchange Format (GIF) 
image files:
=======================================================================

It was found that gdk-pixbuf's gdk_pixbuf__gif_image_load() GIF image 
loader routine did not properly handle certain return values from its
subroutines. A remote attacker could provide a specially-crafted GIF
image, which once opened in an application, linked against gdk-pixbuf
would lead to gdk-pixbuf to return partially initialized pixbuf
structure, possibly having huge width and height, leading to that
particular application termination due excessive memory use.

The CVE identifier of CVE-2011-2485 has been assigned to this issue.

References:

[1] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2485
[2] 
http://git.gnome.org/browse/gdk-pixbuf/commit/?id=f8569bb13e2aa1584dde61ca545144750f7a7c98

This issue could lead (for example) in Pidgin to:
=================================================

A remote attacker could set a specially-crafted GIF image as their
buddy icon that could lead to Pidgin being terminated due to excessive
memory use.

References:
[3] https://bugzilla.redhat.com/show_bug.cgi?id=714754
[4] http://www.pidgin.im/news/security/?id=52

Credit: Issue has been discovered and reported by Mark Doliner
         of the Pidgin project.

We did not allocate a second CVE identifier for the Pidgin issue,
since the true underlying reason for this was the gdk-pixbuf image 
loading library problem. This is based on last paragraph from:
[5] http://www.openwall.com/lists/oss-security/2011/03/30/3

more exactly on that part about 'issues like incorrectly
reporting error status from an API function' (although this not
being case of compiler, but rather case of library).

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.