[Full-Disclosure] MDKSA-2004:095 - Updated gdk-pixbuf packages fix image loading vulnerabilities

From: Mandrake Linux Security Team (security_at_linux-mandrake.com)
Date: 09/15/04

  • Next message: Nicolas Montoza: "Re: [Full-Disclosure] HTMLShip encrypt"
    To: full-disclosure@lists.netsys.com
    Date: 15 Sep 2004 17:10:03 -0000
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

     _______________________________________________________________________

                     Mandrakelinux Security Update Advisory
     _______________________________________________________________________

     Package name: gdk-pixbuf
     Advisory ID: MDKSA-2004:095
     Date: September 15th, 2004

     Affected versions: 10.0, 9.2
     ______________________________________________________________________

     Problem Description:

     A vulnerability was found in the gdk-pixbug bmp loader where a bad BMP
     image could send the bmp loader into an infinite loop (CAN-2004-0753).
     
     Chris Evans found a heap-based overflow and a stack-based overflow in
     the xpm loader of gdk-pixbuf (CAN-2004-0782 and CAN-2004-0783).
     
     Chris Evans also discovered an integer overflow in the ico loader of
     gdk-pixbuf (CAN-2004-0788).
     
     All four problems have been corrected in these updated packages.
     _______________________________________________________________________

     References:

      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0753
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0782
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0783
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0788
     ______________________________________________________________________

     Updated Packages:
      
     Mandrakelinux 10.0:
     f4ffbb227e070e7aace9ff3453c2a9e4 10.0/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.100mdk.i586.rpm
     840fb0f158f3b2aa31a0fffd32d61c95 10.0/RPMS/libgdk-pixbuf-gnomecanvas1-0.22.0-2.1.100mdk.i586.rpm
     a9d68383ba8d8a1ef6d268f5b1564b5e 10.0/RPMS/libgdk-pixbuf-xlib2-0.22.0-2.1.100mdk.i586.rpm
     cdae96796308a0bd13abb2326b6c7d78 10.0/RPMS/libgdk-pixbuf2-0.22.0-2.1.100mdk.i586.rpm
     c0b067a672f8e5e0d0d8c3aec3c00c99 10.0/RPMS/libgdk-pixbuf2-devel-0.22.0-2.1.100mdk.i586.rpm
     89c3c1a2fe969ccdfda42018375fc64b 10.0/SRPMS/gdk-pixbuf-0.22.0-2.1.100mdk.src.rpm

     Mandrakelinux 10.0/AMD64:
     bd4abe68b479da8b4bece492660ddd41 amd64/10.0/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.100mdk.amd64.rpm
     17eaa5527c3fe0686a3c4e438b619690 amd64/10.0/RPMS/lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.1.100mdk.amd64.rpm
     0d70373e01871748ed0cab603d57b497 amd64/10.0/RPMS/lib64gdk-pixbuf-xlib2-0.22.0-2.1.100mdk.amd64.rpm
     0254d717bf8124dbd81cd8e0fa7c2c51 amd64/10.0/RPMS/lib64gdk-pixbuf2-0.22.0-2.1.100mdk.amd64.rpm
     c4ec20acf29b206c818120cfadfc9d8d amd64/10.0/RPMS/lib64gdk-pixbuf2-devel-0.22.0-2.1.100mdk.amd64.rpm
     89c3c1a2fe969ccdfda42018375fc64b amd64/10.0/SRPMS/gdk-pixbuf-0.22.0-2.1.100mdk.src.rpm

     Mandrakelinux 9.2:
     5b14a4d5b7926db20d436ddbc9991448 9.2/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.92mdk.i586.rpm
     aba9d39e7b5dfc2ef8dec18307358f6f 9.2/RPMS/libgdk-pixbuf-gnomecanvas1-0.22.0-2.1.92mdk.i586.rpm
     d80cbaf22163a248bd35c6d1b3fac2c3 9.2/RPMS/libgdk-pixbuf-xlib2-0.22.0-2.1.92mdk.i586.rpm
     bfe975ea60b0c7bf6556a4c174850676 9.2/RPMS/libgdk-pixbuf2-0.22.0-2.1.92mdk.i586.rpm
     0521148ae973bffab1375da9cb91b1ea 9.2/RPMS/libgdk-pixbuf2-devel-0.22.0-2.1.92mdk.i586.rpm
     dee3f2d2738f850c79c938df7ac7c8f8 9.2/SRPMS/gdk-pixbuf-0.22.0-2.1.92mdk.src.rpm

     Mandrakelinux 9.2/AMD64:
     1f1cb7ad69ba3dd98a517370430f74e7 amd64/9.2/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.92mdk.amd64.rpm
     59a41e35d449fc6ecc4d3bb061403d25 amd64/9.2/RPMS/lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.1.92mdk.amd64.rpm
     76c038a1d28272b6341835dd723ccea2 amd64/9.2/RPMS/lib64gdk-pixbuf-xlib2-0.22.0-2.1.92mdk.amd64.rpm
     8a54916d945401bb5c57d6f1e6c525c1 amd64/9.2/RPMS/lib64gdk-pixbuf2-0.22.0-2.1.92mdk.amd64.rpm
     48c50fca72679e4643df8ea0b4d0bf39 amd64/9.2/RPMS/lib64gdk-pixbuf2-devel-0.22.0-2.1.92mdk.amd64.rpm
     dee3f2d2738f850c79c938df7ac7c8f8 amd64/9.2/SRPMS/gdk-pixbuf-0.22.0-2.1.92mdk.src.rpm
     _______________________________________________________________________

     To upgrade automatically use MandrakeUpdate or urpmi. The verification
     of md5 checksums and GPG signatures is performed automatically for you.

     All packages are signed by Mandrakesoft for security. You can obtain
     the GPG public key of the Mandrakelinux Security Team by executing:

      gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

     You can view other update advisories for Mandrakelinux at:

      http://www.mandrakesoft.com/security/advisories

     If you want to report vulnerabilities, please contact

      security_linux-mandrake.com

     Type Bits/KeyID Date User ID
     pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
      <security linux-mandrake.com>
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.7 (GNU/Linux)

    iD8DBQFBSHdrmqjQ0CJFipgRAvVaAKCloGBMo654vub0nJRBIMqnbDrvxQCgm1E3
    Y+jDYDXO+MxgNT70fObdeCs=
    =A8qC
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Nicolas Montoza: "Re: [Full-Disclosure] HTMLShip encrypt"

    Relevant Pages