CVE-2017-6313: Integer Underflow
Integer underflow in the loadresources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.2+dfsg-1+deb11u2Fixed in 2.42.2+dfsg-1+deb11u4Fixed in 2.42.10+dfsg-1+deb12u3Fixed in 2.42.10+dfsg-1+deb12u2Fixed in 2.42.12+dfsg-4Fixed in 2.44.5+dfsg-4
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2017-6313.
What is the severity of CVE-2017-6313?
The severity of CVE-2017-6313 is high.
What is the affected software?
The affected software is gdk-pixbuf.
How can this vulnerability be exploited?
This vulnerability can be exploited by context-dependent attackers through a crafted image entry size in an ICO file, leading to a denial of service.
Is there a fix available for this vulnerability?
Yes, there are fixes available for this vulnerability. For example, the remedy versions for the Ubuntu package gdk-pixbuf are 2.36.11-1ubuntu0.1, 2.30.7-0ubuntu1.8, 2.36.11-2, and 2.32.2-1ubuntu1.4.