CVE-2020-29385: Medium severity Gnome GDK-PixBuf vulnerability
GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function writeindexes. if c->selfcode equals 10, self->codetable[10].extends will assign the value 11 to c. The next execution in the loop will assign self->codetable[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.2+dfsg-1+deb11u2Fixed in 2.42.2+dfsg-1+deb11u1Fixed in 2.42.10+dfsg-1+deb12u1Fixed in 2.42.12+dfsg-2 - Upgrade
Upgrade
alpine/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.40.0-r2 - Upgrade
Upgrade
alpine/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.40.0-r4 - Upgrade
Upgrade
alpine/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.2-r0 - Upgrade
Upgrade
GNOME gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.2
Event History
Frequently Asked Questions
What is CVE-2020-29385?
CVE-2020-29385 is a vulnerability in GNOME gdk-pixbuf that allows a denial of service (infinite loop) in lzw.c.
What is the severity of CVE-2020-29385?
The severity of CVE-2020-29385 is high with a severity value of 5.5.
How does CVE-2020-29385 affect GNOME gdk-pixbuf?
CVE-2020-29385 affects GNOME gdk-pixbuf before version 2.42.2.
Is there a fix available for CVE-2020-29385?
Yes, there are remedies available for CVE-2020-29385 in the affected software.
Where can I find more information about CVE-2020-29385?
You can find more information about CVE-2020-29385 on the MITRE CVE website, the GNOME mailing list, and the Ubuntu Security Notices website.