CVE-2022-48622: High severity Gnome GdkPixbuf vulnerability
In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in aniloadchunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdkpixbufsetoption() in gdk-pixbuf.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.36.11-2ubuntu0.1~ - Upgrade
Upgrade
ubuntu/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.40.0+dfsg-3ubuntu0.5 - Upgrade
Upgrade
ubuntu/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.8+dfsg-1ubuntu0.3 - Upgrade
Upgrade
ubuntu/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.10+dfsg-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.10+dfsg-3ubuntu3.1 - Upgrade
Upgrade
ubuntu/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.32.2-1ubuntu1.6+ - Upgrade
Upgrade
debian/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.10+dfsg-1+deb12u4Fixed in 2.42.12+dfsg-4+deb13u1Fixed in 2.44.8+dfsg-1 - Upgrade
Upgrade
alpine/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.12-r0 - Upgrade
Upgrade
debian/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.10+dfsg-1+deb12u1 - Upgrade
Upgrade
debian/gdk-pixbufto a version that resolves this vulnerability.Fixed in 2.42.12+dfsg-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48622?
CVE-2022-48622 is classified as a high severity vulnerability due to potential heap memory corruption.
How do I fix CVE-2022-48622?
To fix CVE-2022-48622, you should update GdkPixbuf to a version that is not vulnerable, such as 2.42.12 or later.
What systems are affected by CVE-2022-48622?
CVE-2022-48622 affects GdkPixbuf versions up to 2.42.10 across various Linux distributions.
What could an attacker exploit in CVE-2022-48622?
An attacker could exploit CVE-2022-48622 to overwrite heap metadata through a crafted .ani file.
Is CVE-2022-48622 a denial of service vulnerability?
Yes, CVE-2022-48622 can lead to denial of service due to heap memory corruption.