CVE-2020-29385: Medium severity gnome gdkpixbuf vulnerability
GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function writeindexes. if c->selfcode equals 10, self->codetable[10].extends will assign the value 11 to c. The next execution in the loop will assign self->codetable[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-29385?
CVE-2020-29385 is a vulnerability in GNOME gdk-pixbuf that allows a denial of service (infinite loop) in lzw.c.
What is the severity of CVE-2020-29385?
The severity of CVE-2020-29385 is high with a severity value of 5.5.
How does CVE-2020-29385 affect GNOME gdk-pixbuf?
CVE-2020-29385 affects GNOME gdk-pixbuf before version 2.42.2.
Is there a fix available for CVE-2020-29385?
Yes, there are remedies available for CVE-2020-29385 in the affected software.
Where can I find more information about CVE-2020-29385?
You can find more information about CVE-2020-29385 on the MITRE CVE website, the GNOME mailing list, and the Ubuntu Security Notices website.