rpm package
opensuse/gdk-pixbuf&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/gdk-pixbuf&distro=openSUSE%20Tumbleweed
Vulnerabilities (16)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-7345 | Hig | 7.5 | < 2.42.12-5.1 | 2.42.12-5.1 | Jul 8, 2025 | A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds | |
| CVE-2025-6199 | — | < 2.42.12-4.1 | 2.42.12-4.1 | Jun 17, 2025 | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized | ||
| CVE-2022-48622 | — | < 2.42.12-1.1 | 2.42.12-1.1 | Jan 26, 2024 | In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading | ||
| CVE-2021-46829 | — | < 2.42.8-2.1 | 2.42.8-2.1 | Jul 24, 2022 | GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit s | ||
| CVE-2021-44648 | — | < 2.42.9-3.1 | 2.42.9-3.1 | Jan 12, 2022 | GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. | ||
| CVE-2020-29385 | — | < 2.42.6-3.2 | 2.42.6-3.2 | Dec 26, 2020 | GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11] | ||
| CVE-2017-2870 | Hig | 7.8 | < 2.42.6-3.2 | 2.42.6-3.2 | Sep 5, 2017 | An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger th | |
| CVE-2017-2862 | Hig | 7.8 | < 2.42.6-3.2 | 2.42.6-3.2 | Sep 5, 2017 | An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulner | |
| CVE-2017-6313 | Hig | 7.1 | < 2.42.6-3.2 | 2.42.6-3.2 | Mar 10, 2017 | Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file. | |
| CVE-2017-6312 | Med | 5.5 | < 2.42.6-3.2 | 2.42.6-3.2 | Mar 10, 2017 | Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file, which triggers an out-of-bounds read, related to compiler optimizations. | |
| CVE-2016-6352 | Hig | 7.5 | < 2.36.0-1.1 | 2.36.0-1.1 | Oct 3, 2016 | The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file. | |
| CVE-2015-7552 | Hig | 7.8 | < 2.36.0-1.1 | 2.36.0-1.1 | Apr 18, 2016 | Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file. | |
| CVE-2015-7674 | — | < 2.36.0-1.1 | 2.36.0-1.1 | Oct 26, 2015 | Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overf | ||
| CVE-2015-7673 | — | < 2.36.0-1.1 | 2.36.0-1.1 | Oct 26, 2015 | io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file. | ||
| CVE-2015-4491 | — | < 2.36.0-1.1 | 2.36.0-1.1 | Aug 16, 2015 | Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or ca | ||
| CVE-2011-2485 | — | < 2.36.0-1.1 | 2.36.0-1.1 | Jul 3, 2012 | The gdk_pixbuf__gif_image_load function in gdk-pixbuf/io-gif.c in gdk-pixbuf before 2.23.5 does not properly handle certain return values, which allows remote attackers to cause a denial of service (memory consumption) via a crafted GIF image file. |
- affected < 2.42.12-5.1fixed 2.42.12-5.1
A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds
- CVE-2025-6199Jun 17, 2025affected < 2.42.12-4.1fixed 2.42.12-4.1
A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized
- CVE-2022-48622Jan 26, 2024affected < 2.42.12-1.1fixed 2.42.12-1.1
In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading
- CVE-2021-46829Jul 24, 2022affected < 2.42.8-2.1fixed 2.42.8-2.1
GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit s
- CVE-2021-44648Jan 12, 2022affected < 2.42.9-3.1fixed 2.42.9-3.1
GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.
- CVE-2020-29385Dec 26, 2020affected < 2.42.6-3.2fixed 2.42.6-3.2
GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11]
- affected < 2.42.6-3.2fixed 2.42.6-3.2
An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger th
- affected < 2.42.6-3.2fixed 2.42.6-3.2
An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulner
- affected < 2.42.6-3.2fixed 2.42.6-3.2
Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file.
- affected < 2.42.6-3.2fixed 2.42.6-3.2
Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file, which triggers an out-of-bounds read, related to compiler optimizations.
- affected < 2.36.0-1.1fixed 2.36.0-1.1
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- affected < 2.36.0-1.1fixed 2.36.0-1.1
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
- CVE-2015-7674Oct 26, 2015affected < 2.36.0-1.1fixed 2.36.0-1.1
Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overf
- CVE-2015-7673Oct 26, 2015affected < 2.36.0-1.1fixed 2.36.0-1.1
io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file.
- CVE-2015-4491Aug 16, 2015affected < 2.36.0-1.1fixed 2.36.0-1.1
Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or ca
- CVE-2011-2485Jul 3, 2012affected < 2.36.0-1.1fixed 2.36.0-1.1
The gdk_pixbuf__gif_image_load function in gdk-pixbuf/io-gif.c in gdk-pixbuf before 2.23.5 does not properly handle certain return values, which allows remote attackers to cause a denial of service (memory consumption) via a crafted GIF image file.