MDKSA-2004:095 - Updated gdk-pixbuf packages fix image loading vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandrakelinux Security Update Advisory
_______________________________________________________________________
Package name: gdk-pixbuf
Advisory ID: MDKSA-2004:095
Date: September 15th, 2004
Affected versions: 10.0, 9.2
______________________________________________________________________
Problem Description:
A vulnerability was found in the gdk-pixbug bmp loader where a bad BMP
image could send the bmp loader into an infinite loop (CAN-2004-0753).
Chris Evans found a heap-based overflow and a stack-based overflow in
the xpm loader of gdk-pixbuf (CAN-2004-0782 and CAN-2004-0783).
Chris Evans also discovered an integer overflow in the ico loader of
gdk-pixbuf (CAN-2004-0788).
All four problems have been corrected in these updated packages.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0753
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0782
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0783
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0788
______________________________________________________________________
Updated Packages:
Mandrakelinux 10.0:
f4ffbb227e070e7aace9ff3453c2a9e4
10.0/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.100mdk.i586.rpm
840fb0f158f3b2aa31a0fffd32d61c95
10.0/RPMS/libgdk-pixbuf-gnomecanvas1-0.22.0-2.1.100mdk.i586.rpm
a9d68383ba8d8a1ef6d268f5b1564b5e
10.0/RPMS/libgdk-pixbuf-xlib2-0.22.0-2.1.100mdk.i586.rpm
cdae96796308a0bd13abb2326b6c7d78
10.0/RPMS/libgdk-pixbuf2-0.22.0-2.1.100mdk.i586.rpm
c0b067a672f8e5e0d0d8c3aec3c00c99
10.0/RPMS/libgdk-pixbuf2-devel-0.22.0-2.1.100mdk.i586.rpm
89c3c1a2fe969ccdfda42018375fc64b
10.0/SRPMS/gdk-pixbuf-0.22.0-2.1.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
bd4abe68b479da8b4bece492660ddd41
amd64/10.0/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.100mdk.amd64.rpm
17eaa5527c3fe0686a3c4e438b619690
amd64/10.0/RPMS/lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.1.100mdk.amd64.rpm
0d70373e01871748ed0cab603d57b497
amd64/10.0/RPMS/lib64gdk-pixbuf-xlib2-0.22.0-2.1.100mdk.amd64.rpm
0254d717bf8124dbd81cd8e0fa7c2c51
amd64/10.0/RPMS/lib64gdk-pixbuf2-0.22.0-2.1.100mdk.amd64.rpm
c4ec20acf29b206c818120cfadfc9d8d
amd64/10.0/RPMS/lib64gdk-pixbuf2-devel-0.22.0-2.1.100mdk.amd64.rpm
89c3c1a2fe969ccdfda42018375fc64b
amd64/10.0/SRPMS/gdk-pixbuf-0.22.0-2.1.100mdk.src.rpm
Mandrakelinux 9.2:
5b14a4d5b7926db20d436ddbc9991448
9.2/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.92mdk.i586.rpm
aba9d39e7b5dfc2ef8dec18307358f6f
9.2/RPMS/libgdk-pixbuf-gnomecanvas1-0.22.0-2.1.92mdk.i586.rpm
d80cbaf22163a248bd35c6d1b3fac2c3
9.2/RPMS/libgdk-pixbuf-xlib2-0.22.0-2.1.92mdk.i586.rpm
bfe975ea60b0c7bf6556a4c174850676
9.2/RPMS/libgdk-pixbuf2-0.22.0-2.1.92mdk.i586.rpm
0521148ae973bffab1375da9cb91b1ea
9.2/RPMS/libgdk-pixbuf2-devel-0.22.0-2.1.92mdk.i586.rpm
dee3f2d2738f850c79c938df7ac7c8f8 9.2/SRPMS/gdk-pixbuf-0.22.0-2.1.92mdk.src.rpm
Mandrakelinux 9.2/AMD64:
1f1cb7ad69ba3dd98a517370430f74e7
amd64/9.2/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.92mdk.amd64.rpm
59a41e35d449fc6ecc4d3bb061403d25
amd64/9.2/RPMS/lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.1.92mdk.amd64.rpm
76c038a1d28272b6341835dd723ccea2
amd64/9.2/RPMS/lib64gdk-pixbuf-xlib2-0.22.0-2.1.92mdk.amd64.rpm
8a54916d945401bb5c57d6f1e6c525c1
amd64/9.2/RPMS/lib64gdk-pixbuf2-0.22.0-2.1.92mdk.amd64.rpm
48c50fca72679e4643df8ea0b4d0bf39
amd64/9.2/RPMS/lib64gdk-pixbuf2-devel-0.22.0-2.1.92mdk.amd64.rpm
dee3f2d2738f850c79c938df7ac7c8f8
amd64/9.2/SRPMS/gdk-pixbuf-0.22.0-2.1.92mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFBSHdrmqjQ0CJFipgRAvVaAKCloGBMo654vub0nJRBIMqnbDrvxQCgm1E3
Y+jDYDXO+MxgNT70fObdeCs=
=A8qC
-----END PGP SIGNATURE-----