CVE-2021-44648: Buffer Overflow
GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.
References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44648 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44648 http://www.cvedetails.com/cve/CVE-2021-44648/ https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/136 https://sahildhar.github.io/blogpost/GdkPixbuf-Heap-Buffer-Overflow-in-lzwdecodernew/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.38.1+dfsg-1Fixed in 2.42.2+dfsg-1+deb11u1Fixed in 2.42.10+dfsg-1 - Upgrade
Upgrade
alpine/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.8-r0
Event History
Frequently Asked Questions
What is CVE-2021-44648?
CVE-2021-44648 is a vulnerability in GNOME gdk-pixbuf 2.42.6 that allows for a heap-buffer overflow when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.
What is the severity of CVE-2021-44648?
CVE-2021-44648 has a severity rating of 8.8 (high).
Which software versions are affected by CVE-2021-44648?
GNOME gdk-pixbuf 2.42.6, Fedoraproject Fedora 34 and 35, and Debian Debian Linux 11.0 are affected by CVE-2021-44648.
How can I fix CVE-2021-44648?
To fix CVE-2021-44648, update gdk-pixbuf to version 2.38.1+dfsg-1, 2.42.2+dfsg-1+deb11u1, or 2.42.10+dfsg-1.
Where can I find more information about CVE-2021-44648?
You can find more information about CVE-2021-44648 at the following references: [1] [2] [3].