Stay Secure with the Latest Linux Advisories

security advisoryGentooDoS

Gentoo: GLSA-201709-08 Normal: GDK-PixBuf Multiple Code Issues

Multiple vulnerabilities have been found in GDK-PixBuf, the worst of which could result in the execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201709-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: GDK-PixBuf: Multiple vulnerabilities Date: September 17, 2017 Bugs: #592976, #611390, #630026 ID: 201709-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in GDK-PixBuf, the worst of which could result in the execution of arbitrary code. Background ========= GDK-PixBuf is an image loading library for GTK+. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 x11-libs/gdk-pixbuf < 2.36.9 > = 2.36.9 Description ========== Multiple vulnerabilities have been discovered in GDK-PixBuf. Please review the referenced CVE identifiers for details. Impact ===== A remote attacker, by sending a specially crafted TIFF, JPEG, or URL, could execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All GDK-PixBuf users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =x11-libs/gdk-pixbuf-2.36.9" Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages. References ========= [ 1 ] CVE-2017-6311 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6311 [ 2 ] CVE-2017-6312 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6312 [ 3 ] CVE-2017-6313 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6313 [ 4 ] CVE-2017-6314 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6314 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201709-08 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . The GDK-PixBuf software contains several security flaws that may allow remote adversaries to run unauthorized code or trigger a denial of service (DoS) scenario.. GDK-PixBuf Issues, Gentoo Security Advisory, Code Execution Risks, Image Library Attacks. . LinuxSecurity.com Team

Sep 17, 2017 Gentoo