LBA-Linux Advisory: gdk-pixbuf

---

LBA-Linux Security Advisory

Subject: Updated gdk-pixbuf package for LBA-Linux R1
Advisory ID: LBASA-2004:36
Date: Sunday, September 19, 2004
Product: LBA-Linux R1

---

Problem description:

During testing of a previously fixed flaw in Qt (CAN-2004-0691),
a flaw was discovered in the BMP image processor of gdk-pixbuf. An
attacker could create a carefully crafted BMP file which would
cause an application to enter an infinite loop and not respond to
user input when the file was opened by a victim. The Common
Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2004-0753 to this issue.

During a security audit, Chris Evans discovered a stack and a
heap overflow in the XPM image decoder. An attacker could create a
carefully crafted XPM file which could cause an application linked
with gtk2 to crash or possibly execute arbitrary code when the file
was opened by a victim. (CAN-2004-0782, CAN-2004-0783)

Chris Evans also discovered an integer overflow in the ICO image
decoder. An attacker could create a carefully crafted ICO file
which could cause an application linked with gtk2 to crash when the
file is opened by a victim. (CAN-2004-0788)

Updated packages:

LBA-Linux R1:

i386:

ftp://ftp.sot.com/lba-linux_r1/apt/RPMS.updates/gdk-pixbuf-0.22.0-5.0.lba.2.i386.rpm

ftp://ftp.sot.com/lba-linux_r1/apt/RPMS.updates/gdk-pixbuf-devel-0.22.0-5.0.lba.2.i386.rpm

ftp://ftp.sot.com/lba-linux_r1/apt/RPMS.updates/gdk-pixbuf-gnome-0.22.0-5.0.lba.2.i386.rpm

Upgrading your system:

To apply this security update to your LBA-Linux system, run the
Updater tool from the LBA-Linux root desktop:

1. Log in to your LBA-Linux desktop as the root user.
2. Click on the penguin icon at the lower left of the display, and
   select the menu item SYSTEM TOOLS>UPDATER.
3. Click on the item named gdk-pixbuf to highlight it.
4. Click on the PACKAGE menu in the menu bar, and select the
   UPGRADE action.
5. Confirm the upgrade by clicking the APPLY button in Updater’s
   main toolbar.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0753

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0782

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0783

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0788

Copyright(c) 2001-2004 SOT