From security@linux-mandrake.com Thu Sep 16 02:39:04 2004 From: Mandrake Linux Security Team To: bugtraq@securityfocus.com Date: 15 Sep 2004 17:10:03 -0000 Subject: MDKSA-2004:095 - Updated gdk-pixbuf packages fix image loading vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandrakelinux Security Update Advisory _______________________________________________________________________ Package name: gdk-pixbuf Advisory ID: MDKSA-2004:095 Date: September 15th, 2004 Affected versions: 10.0, 9.2 ______________________________________________________________________ Problem Description: A vulnerability was found in the gdk-pixbug bmp loader where a bad BMP image could send the bmp loader into an infinite loop (CAN-2004-0753). Chris Evans found a heap-based overflow and a stack-based overflow in the xpm loader of gdk-pixbuf (CAN-2004-0782 and CAN-2004-0783). Chris Evans also discovered an integer overflow in the ico loader of gdk-pixbuf (CAN-2004-0788). All four problems have been corrected in these updated packages. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0753 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0782 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0783 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0788 ______________________________________________________________________ Updated Packages: Mandrakelinux 10.0: f4ffbb227e070e7aace9ff3453c2a9e4 10.0/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.100mdk.i586.rpm 840fb0f158f3b2aa31a0fffd32d61c95 10.0/RPMS/libgdk-pixbuf-gnomecanvas1-0.22.0-2.1.100mdk.i586.rpm a9d68383ba8d8a1ef6d268f5b1564b5e 10.0/RPMS/libgdk-pixbuf-xlib2-0.22.0-2.1.100mdk.i586.rpm cdae96796308a0bd13abb2326b6c7d78 10.0/RPMS/libgdk-pixbuf2-0.22.0-2.1.100mdk.i586.rpm c0b067a672f8e5e0d0d8c3aec3c00c99 10.0/RPMS/libgdk-pixbuf2-devel-0.22.0-2.1.100mdk.i586.rpm 89c3c1a2fe969ccdfda42018375fc64b 10.0/SRPMS/gdk-pixbuf-0.22.0-2.1.100mdk.src.rpm Mandrakelinux 10.0/AMD64: bd4abe68b479da8b4bece492660ddd41 amd64/10.0/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.100mdk.amd64.rpm 17eaa5527c3fe0686a3c4e438b619690 amd64/10.0/RPMS/lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.1.100mdk.amd64.rpm 0d70373e01871748ed0cab603d57b497 amd64/10.0/RPMS/lib64gdk-pixbuf-xlib2-0.22.0-2.1.100mdk.amd64.rpm 0254d717bf8124dbd81cd8e0fa7c2c51 amd64/10.0/RPMS/lib64gdk-pixbuf2-0.22.0-2.1.100mdk.amd64.rpm c4ec20acf29b206c818120cfadfc9d8d amd64/10.0/RPMS/lib64gdk-pixbuf2-devel-0.22.0-2.1.100mdk.amd64.rpm 89c3c1a2fe969ccdfda42018375fc64b amd64/10.0/SRPMS/gdk-pixbuf-0.22.0-2.1.100mdk.src.rpm Mandrakelinux 9.2: 5b14a4d5b7926db20d436ddbc9991448 9.2/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.92mdk.i586.rpm aba9d39e7b5dfc2ef8dec18307358f6f 9.2/RPMS/libgdk-pixbuf-gnomecanvas1-0.22.0-2.1.92mdk.i586.rpm d80cbaf22163a248bd35c6d1b3fac2c3 9.2/RPMS/libgdk-pixbuf-xlib2-0.22.0-2.1.92mdk.i586.rpm bfe975ea60b0c7bf6556a4c174850676 9.2/RPMS/libgdk-pixbuf2-0.22.0-2.1.92mdk.i586.rpm 0521148ae973bffab1375da9cb91b1ea 9.2/RPMS/libgdk-pixbuf2-devel-0.22.0-2.1.92mdk.i586.rpm dee3f2d2738f850c79c938df7ac7c8f8 9.2/SRPMS/gdk-pixbuf-0.22.0-2.1.92mdk.src.rpm Mandrakelinux 9.2/AMD64: 1f1cb7ad69ba3dd98a517370430f74e7 amd64/9.2/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.92mdk.amd64.rpm 59a41e35d449fc6ecc4d3bb061403d25 amd64/9.2/RPMS/lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.1.92mdk.amd64.rpm 76c038a1d28272b6341835dd723ccea2 amd64/9.2/RPMS/lib64gdk-pixbuf-xlib2-0.22.0-2.1.92mdk.amd64.rpm 8a54916d945401bb5c57d6f1e6c525c1 amd64/9.2/RPMS/lib64gdk-pixbuf2-0.22.0-2.1.92mdk.amd64.rpm 48c50fca72679e4643df8ea0b4d0bf39 amd64/9.2/RPMS/lib64gdk-pixbuf2-devel-0.22.0-2.1.92mdk.amd64.rpm dee3f2d2738f850c79c938df7ac7c8f8 amd64/9.2/SRPMS/gdk-pixbuf-0.22.0-2.1.92mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandrakesoft for security. You can obtain the GPG public key of the Mandrakelinux Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandrakelinux at: http://www.mandrakesoft.com/security/advisories If you want to report vulnerabilities, please contact security_linux-mandrake.com Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQFBSHdrmqjQ0CJFipgRAvVaAKCloGBMo654vub0nJRBIMqnbDrvxQCgm1E3 Y+jDYDXO+MxgNT70fObdeCs= =A8qC -----END PGP SIGNATURE-----