831077 – (CVE-2021-44648) <x11-libs/gdk-pixbuf-2.42.9: heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files (CVE-2021-44648)

Bug 831077 (CVE-2021-44648) - <x11-libs/gdk-pixbuf-2.42.9: heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files (CVE-2021-44648)

Summary: <x11-libs/gdk-pixbuf-2.42.9: heap-buffer overflow vulnerability when decoding...

Status:	IN_PROGRESS

Alias:	CVE-2021-44648

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://gitlab.gnome.org/GNOME/gdk-pi...
Whiteboard:	B3 [glsa?]
Keywords:

Depends on:	879807
Blocks:
	Show dependency tree

Reported:	2022-01-12 16:43 UTC by filip ambroz
Modified:	2023-01-06 17:26 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description filip ambroz 2022-01-12 16:43:40 UTC

The GdkPixbuf library is vulnerable to heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.

URLs:
https://nvd.nist.gov/vuln/detail/CVE-2021-44648
https://sahildhar.github.io/blogpost/GdkPixbuf-Heap-Buffer-Overflow-in-lzw_decoder_new/

Reproducible: Always

Comment 1 John Helmert III archtester

2022-08-16 22:40:21 UTC

Looks like the patch made it into 2.42.9:

https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/8ad828c2782355c1747c62b3700bdc052e12e241

Please stabilize when ready.