CVE-2022-48622: High severity gnome gdkpixbuf vulnerability
In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in aniloadchunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdkpixbufsetoption() in gdk-pixbuf.c.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48622?
CVE-2022-48622 is classified as a high severity vulnerability due to potential heap memory corruption.
How do I fix CVE-2022-48622?
To fix CVE-2022-48622, you should update GdkPixbuf to a version that is not vulnerable, such as 2.42.12 or later.
What systems are affected by CVE-2022-48622?
CVE-2022-48622 affects GdkPixbuf versions up to 2.42.10 across various Linux distributions.
What could an attacker exploit in CVE-2022-48622?
An attacker could exploit CVE-2022-48622 to overwrite heap metadata through a crafted .ani file.
Is CVE-2022-48622 a denial of service vulnerability?
Yes, CVE-2022-48622 can lead to denial of service due to heap memory corruption.