Fedora Core 2: 2005-267 Moderate: Gtk2 Denial Of Service Attack

GTK+ is a multi-platform toolkit for creating graphical user

interfaces. Offering a complete set of widgets, GTK+ is suitable for

projects ranging from small one-off tools to complete application

suites.

David Costanzo found a bug in the way GTK+ processes BMP images.

It is possible that a specially crafted BMP image could cause a denial

of service attack in applications linked against GTK+.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has

assigned the name CAN-2005-0891 to this issue.

- Fix a double free in the bmp loader

e554a876457e37b8a432191af098b455 SRPMS/gtk2-2.4.14-2.fc2.src.rpm

e0ab627f18c00ea25257d7c0e82baa30 x86_64/gtk2-2.4.14-2.fc2.x86_64.rpm

bffbdf4fb9ad6c0803c61994b4f3f125 x86_64/gtk2-devel-2.4.14-2.fc2.x86_64.rpm

64febbae57060204343e0f212279a3b8 x86_64/debug/gtk2-debuginfo-2.4.14-2.fc2.x86_64.rpm

40137c8115b35e5f92cc4ac764b7c04e x86_64/gtk2-2.4.14-2.fc2.i386.rpm

40137c8115b35e5f92cc4ac764b7c04e i386/gtk2-2.4.14-2.fc2.i386.rpm

1fd50f68800ac67282143c0d02e5be09 i386/gtk2-devel-2.4.14-2.fc2.i386.rpm

749b4834dfe87cdcf3133a9d859e5b91 i386/debug/gtk2-debuginfo-2.4.14-2.fc2.i386.rpm

This update can also be installed with the Update Agent; you can

launch the Update Agent with the 'up2date' command.

--fedora-announce-list mailing list

fedora-announce-list@redhat.com