| Summary: | gtk+2.0 new integer overflow security issue (CVE-2013-7447) | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Atilla ÖNTAŞ <tarakbumba> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | sysadmin-bugs, tarazed25 |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/675834/ | ||
| Whiteboard: | has_procedure advisory MGA5-64-OK MGA5-32-OK | ||
| Source RPM: | gtk+2.0-2.24.26-3.mga5.src.rpm | CVE: | |
| Status comment: | |||
| Bug Depends on: | |||
| Bug Blocks: | 17731 | ||
|
Description
Atilla ÖNTAŞ
2016-02-11 22:56:28 CET
Atilla ÖNTAŞ
2016-02-11 23:06:24 CET
Blocks:
(none) =>
17731
David Walser
2016-02-12 00:49:11 CET
Severity:
critical =>
major mga5 x86_64 Mate Obtained the PNG image via the link. Tried out eom and it displayed an image frame and immediately crashed. eog hung for a long time, displaying a grey square until a popup reported that eog was not responding. Forced quit but something was running in the background, using all eight cores and slowing down the system. Going for the update. CC:
(none) =>
tarazed25 When it reaches the mirrors. Updated gtk+2 and gtk lib packages. These hauled in another 17 packages: Core Release graphite2-1.2.4-3.mga5 lib64cairo-devel-1.14.0-1.mga5 lib64directfb-devel-1.7.5-4.mga5 lib64fontconfig-devel-2.11.1-4.mga5 lib64graphite2-devel-1.2.4-3.mga5 lib64harfbuzz-devel-0.9.36-1.mga5 lib64pango1.0-devel-1.36.8-3.mga5 lib64xcomposite-devel-0.4.4-7.mga5 lib64xcursor-devel-1.1.14-5.mga5 lib64xft-devel-2.3.2-3.mga5 lib64xi-devel-1.7.4-3.mga5 lib64xrandr-devel-1.4.2-4.mga5 lib64xrender-devel-0.9.8-5.mga5 pango-doc-1.36.8-3.mga5.noarch Core Updates lib64gdk_pixbuf2.0-devel-2.32.1-1.mga5 lib64pixman-devel-0.32.8-1.mga5 Tainted Release lib64freetype6-devel-2.5.4-2.mga5.tainted Used updated eom to view a number of astronomical images (JPEG) and the test PNG image. The latter was presented as a black square measuring 27000x27000 compressed on-screen by a factor of 25x25, i.e. 4%. $ eog 27000_27000_1437947845.png (eog:9562): EOG-WARNING **: Error loading Eog typelib: Typelib file for namespace 'Eog', version '3.0' not found (eog:9562): libpeas-WARNING **: Type not found in introspection: 'EogApplicationActivatable' (eog:9562): libpeas-WARNING **: Method 'EogApplicationActivatable.activate' was not found (eog:9562): libpeas-WARNING **: Type not found in introspection: 'EogWindowActivatable' (eog:9562): libpeas-WARNING **: Method 'EogWindowActivatable.activate' was not found (eog:9562): Gdk-WARNING **: eog: Fatal IO error 2 (No such file or directory) on X server :0. Everything ground to a halt while eog was attempting to display the image. firefox noticed this eventually and issued a warning about "a script on this page is not responding". Moving between workspaces was painfully slow until it crashed. The upshot of this is that the updated gtk+2 works. If you agree with this Attila I shall give it the OK. Correction to comment #3: read 4% as 4%x4% Eughh! Another error in comment #3: eom version was eom-1.8.1-2.mga5, not updated. eog requires libgtk-3 by the look of it so is irrelevant to this update. Should have used gqview (package geeqie). Just tried it and it displayed all the images in the test directory. It had no trouble with the test PNG file.
Len Lawrence
2016-02-12 11:26:35 CET
Whiteboard:
(none) =>
has_procedure MGA5-64-OK mga5 i586 in virtualbox Mate gtk+2.0 already at updated version. Downloaded the large PNG image file. $ eom 27000_27000_1437947845.png This failed for lack of memory. Closed down the virtual machine and increased memory from 1.3GB to 4.8GB and rebooted the vm. This time eom (pre-update) displayed the PNG image without any trouble. gqview also displayed the image. $ urpmq --requires-recursive geeqie | grep gtk gtk+2.0 gtk+3.0 libgtk+-x11-2.0_0 libgtk+2.0_0 libgtk+3_0 xdg-user-dirs-gtk Validating the update on the strength of this. Please push to updates.
Len Lawrence
2016-02-13 16:38:00 CET
Whiteboard:
has_procedure MGA5-64-OK =>
has_procedure MGA5-64-OK MGA5-32-OK
Len Lawrence
2016-02-13 16:38:17 CET
Keywords:
(none) =>
validated_update Advisory uploaded. Whiteboard:
has_procedure MGA5-64-OK MGA5-32-OK =>
has_procedure advisory MGA5-64-OK MGA5-32-OK
David Walser
2016-02-16 20:24:59 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/675834/ An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0069.html Status:
NEW =>
RESOLVED |