REDHAT-BUG-2373147: Low severity Gnome GdkPixbuf vulnerability
Information Disclosure via uninitialized heap memory exposure in GdkPixbuf’s GIF LZW decoder. Upon encountering an invalid LZW symbol, the decoder incorrectly returns the full buffer length instead of the number of decoded bytes written. This oversight leads to uninitialized memory regions in the output image. A crafted GIF can be used to leak memory contents by processing and then reading back the resulting pixbuf.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2373147?
The severity of REDHAT-BUG-2373147 is classified as a medium risk due to information disclosure vulnerabilities.
How does REDHAT-BUG-2373147 affect GdkPixbuf's GIF LZW decoder?
REDHAT-BUG-2373147 affects GdkPixbuf's GIF LZW decoder by exposing uninitialized heap memory when an invalid LZW symbol is encountered.
How do I mitigate REDHAT-BUG-2373147 in my application?
To mitigate REDHAT-BUG-2373147, update GdkPixbuf to the latest version that addresses the uninitialized memory exposure.
What systems are impacted by REDHAT-BUG-2373147?
Systems utilizing GdkPixbuf's GIF LZW decoder are impacted by REDHAT-BUG-2373147.
What are the potential risks associated with REDHAT-BUG-2373147?
The potential risks associated with REDHAT-BUG-2373147 include exposure of sensitive information stored in uninitialized memory regions.