Heap-based buffer overflow in Gnome gdk-pixbuf - CVE-2021-44648

Vulnerability identifier: #VU67161

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-44648

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when decoding the lzw compressed stream of image data in GIF files. A remote attacker can trick the victim to open a specially crafted GIF file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Gnome gdk-pixbuf
Amazon Linux AMI
Oracle Linux
Debian Linux
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
openSUSE Leap Micro
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
Ubuntu
Fedora
libgdk-pixbuf2.0-0 (Ubuntu package)
gdk-pixbuf-query-loaders-32bit-debuginfo
gdk-pixbuf-devel-32bit
typelib-1_0-GdkPixdata-2_0
gdk-pixbuf-thumbnailer-debuginfo
gdk-pixbuf-thumbnailer
gdk-pixbuf-devel-debuginfo
gdk-pixbuf-devel
typelib-1_0-GdkPixbuf-2_0
libgdk_pixbuf-2_0-0-debuginfo
libgdk_pixbuf-2_0-0
gdk-pixbuf-query-loaders-debuginfo
gdk-pixbuf-query-loaders
gdk-pixbuf-debugsource
gdk-pixbuf-devel-32bit-debuginfo
gdk-pixbuf-query-loaders-32bit
libgdk_pixbuf-2_0-0-32bit
libgdk_pixbuf-2_0-0-32bit-debuginfo
gdk-pixbuf-lang
gdk-pixbuf (Debian package)
gdk-pixbuf2 (Red Hat package)
gdk-pixbuf2
gdk-pixbuf2-devel
gdk-pixbuf2-modules
mingw-gdk-pixbuf
gdk-pixbuf2-doc
libgdk-pixbuf-2.0-0 (Ubuntu package)

Install updates from vendor's website.

Gnome gdk-pixbuf - update to 2.42.8
libgdk-pixbuf2.0-0 (Ubuntu package) - update to 2.40.0+dfsg-3ubuntu0.4
gdk-pixbuf-query-loaders-32bit-debuginfo - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-devel-32bit - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
typelib-1_0-GdkPixdata-2_0 - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-thumbnailer-debuginfo - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-thumbnailer - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-devel-debuginfo - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-devel - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
typelib-1_0-GdkPixbuf-2_0 - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
libgdk_pixbuf-2_0-0-debuginfo - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
libgdk_pixbuf-2_0-0 - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-query-loaders-debuginfo - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-query-loaders - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-debugsource - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-devel-32bit-debuginfo - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-query-loaders-32bit - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
libgdk_pixbuf-2_0-0-32bit - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
libgdk_pixbuf-2_0-0-32bit-debuginfo - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf-lang - addressed in versions 2.40.0-150200.3.9.1, 2.42.9-150400.5.6.1
gdk-pixbuf (Debian package) - update to 2.42.2+dfsg-1+deb11u1
gdk-pixbuf2 (Red Hat package) - update to 2.42.6-3.el9
gdk-pixbuf2 - addressed in versions 2.42.6-3.0.1, 2.42.6-4.0.1
gdk-pixbuf2-devel - addressed in versions 2.42.6-3.0.1, 2.42.6-4.0.1
gdk-pixbuf2-modules - addressed in versions 2.42.6-3.0.1, 2.42.6-4.0.1
mingw-gdk-pixbuf - addressed in versions 2.42.6-4.fc34, 2.42.6-4.fc35
gdk-pixbuf2-doc - update to 2.42.6-4.0.1
libgdk-pixbuf-2.0-0 (Ubuntu package) - update to 2.42.8+dfsg-1ubuntu0.1
gdk-pixbuf2 - update to 2.42.10-1

• https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/136
• https://sahildhar.github.io/blogpost/GdkPixbuf-Heap-Buffer-Overflow-in-lzw_decoder_new/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEVTOGIJITK2N5AOOLKKMDIICZDQE6CH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/

• Remote code execution in GNOME GDK-PixBuf
• SUSE update for gdk-pixbuf
• SUSE update for gdk-pixbuf
• Debian update for gdk-pixbuf
• Ubuntu update for gdk-pixbuf
• Red Hat Enterprise Linux 9 update for gdk-pixbuf2
• Multiple vulnerabilities in Oracle Linux
• Fedora 34 update for mingw-gdk-pixbuf
• Fedora 35 update for mingw-gdk-pixbuf
• Amazon Linux AMI update for gdk-pixbuf2
• Anolis OS update for gdk-pixbuf2
• Anolis OS update for gdk-pixbuf2