Published: 03/10/2016 Updated: 19/12/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The OneLine32 function in io-ico.c in gdk-pixbuf prior to 2.35.3 allows remote malicious users to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
gnome gdk-pixbuf
opensuse opensuse 13.2
opensuse leap 42.1

Debian Bug report logs - #832496 gdk-pixbuf: CVE-2016-6352: ico loader crashes when loading crafted file Package: src:gdk-pixbuf; Maintainer for src:gdk-pixbuf is Debian GNOME Maintainers <pkg-gnome-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 26 Jul 2016 04:33 ...

GDK-PixBuf could be made to crash or run programs as your login if it opened a specially crafted file ...

The OneLine32 function in io-icoc in gdk-pixbuf before 2353 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file ...

An out-of-bounds write has been discovered in the OneLine32() function while parsing an ico file A maliciously crafted file can cause the application to crash or possibly execute arbitrary code ...

CWE-787 https://git.gnome.org/browse/gdk-pixbuf/commit/?id=88af50a864195da1a4f7bda5f02539704fbda599 http://www.openwall.com/lists/oss-security/2016/07/13/11 http://lists.opensuse.org/opensuse-updates/2016-09/msg00040.html https://git.gnome.org/browse/gdk-pixbuf/tree/NEWS?id=640134c46221689d263369872937192e4484c83b http://www.openwall.com/lists/oss-security/2016/07/26/11 http://www.ubuntu.com/usn/USN-3085-1 https://bugzilla.gnome.org/show_bug.cgi?id=769170 https://lists.debian.org/debian-lts-announce/2019/12/msg00025.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832496 https://usn.ubuntu.com/3085-1/https://nvd.nist.gov

CVE-2016-6352

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect