CVE-2015-4491: Buffer Overflow
Integer overflow in the makefiltertable function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.
Other sources
Security researcher Gustavo Grieco reported a heap overflow in gdk-pixbuf affecting Linux systems using Gnome. This issue is triggered by the scaling of a malformed bitmap format image and results in a potentially exploitable crash.
This issue only affects Linux systems running Gnome. Windows and OS X operating systems are unaffected.
External Reference:
https://www.mozilla.org/security/announce/2015/mfsa2015-88.html
Acknowledgements:
Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Gustavo Grieco as the original reporter.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4491?
CVE-2015-4491 has a high severity level due to its potential to allow remote code execution.
How do I fix CVE-2015-4491?
To fix CVE-2015-4491, upgrade gdk-pixbuf to version 2.31.5 or later.
Which software is affected by CVE-2015-4491?
CVE-2015-4491 affects gdk-pixbuf versions before 2.31.5, as well as specific versions of Mozilla Firefox and some Linux distributions.
Can I still use older versions of Firefox with CVE-2015-4491?
Using older versions of Firefox impacted by CVE-2015-4491 poses a security risk and is not recommended.
Is CVE-2015-4491 related to any specific operating systems?
CVE-2015-4491 specifically affects certain versions of Oracle Solaris, Ubuntu, Fedora, and openSUSE.