GNOME gdk-pixbuf up to 2.42.10 ANI Decoder io-ani.c gdk_pixbuf_set_option heap-based overflow

Summaryinfo

A vulnerability described as critical has been identified in GNOME gdk-pixbuf up to 2.42.10. The impacted element is the function gdk_pixbuf_set_option of the file io-ani.c of the component ANI Decoder. The manipulation results in heap-based overflow. This vulnerability was named CVE-2022-48622. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, was found in GNOME gdk-pixbuf up to 2.42.10. Affected is the function gdk_pixbuf_set_option of the file io-ani.c of the component ANI Decoder. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on availability. CVE summarizes:

In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.

The weakness was presented 01/26/2024. The advisory is available at gitlab.gnome.org. This vulnerability is traded as CVE-2022-48622. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 207762 (CBL Mariner 2.0 Security Update: gdk-pixbuf2 (CVE-2022-48622)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (207762). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• GNOME

Name

• gdk-pixbuf

Version

• 2.42.0
• 2.42.1
• 2.42.2
• 2.42.3
• 2.42.4
• 2.42.5
• 2.42.6
• 2.42.7
• 2.42.8
• 2.42.9
• 2.42.10

License

• open-source

Website

• Vendor: https://www.gnome.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion