Bug 19070 - gdk-pixbuf2.0 new security issue CVE-2016-6352
Summary: gdk-pixbuf2.0 new security issue CVE-2016-6352
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/700113/
Whiteboard: MGA5-64-OK MGA5-32-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-07-27 23:47 CEST by David Walser
Modified: 2016-09-25 17:46 CEST (History)
4 users (show)

See Also:
Source RPM: gdk-pixbuf2.0-2.34.0-1.mga6.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2016-07-27 23:47:03 CEST
A CVE has been assigned for a security issue in gdk-pixbuf2.0:
http://openwall.com/lists/oss-security/2016/07/26/11

The upstream bug is here:
https://bugzilla.gnome.org/show_bug.cgi?id=769170

There is no fix available yet.

Mageia 5 is also affected.
David Walser 2016-07-27 23:47:13 CEST

Whiteboard: (none) => MGA5TOO

Comment 1 Marja Van Waes 2016-07-28 08:26:09 CEST
Assigning to all packagers collectively, since there is no maintainer for this package.

CC: (none) => marja11
Assignee: bugsquad => pkg-bugs

Comment 2 David Walser 2016-09-09 17:46:47 CEST
openSUSE has issued an advisory for this today (September 9):
https://lists.opensuse.org/opensuse-updates/2016-09/msg00040.html

Patched packages uploaded for Mageia 5 and Cauldron.

Mageia 5 was also updated to 2.32.3 (as was openSUSE).

Advisory:
========================

Updated gdk-pixbuf2.0 packages fix security vulnerability:

A write out-of-bounds parsing an ico file was found in gdk-pixbuf. A
maliciously crafted file can cause the application to crash (CVE-2016-6352).

The gdk-pixbuf2.0 package has been updated to version 2.32.3 and patched to fix
this issue, and a few other possible security issues.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6352
https://git.gnome.org/browse/gdk-pixbuf/tree/NEWS?h=gdk-pixbuf-2-32&id=c09a36169fdb97fcb937acc7c08909b1fb99e952
https://lists.opensuse.org/opensuse-updates/2016-09/msg00040.html
========================

Updated packages in core/updates_testing:
========================
gdk-pixbuf2.0-2.32.3-1.mga5
libgdk_pixbuf2.0_0-2.32.3-1.mga5
libgdk_pixbuf2.0-devel-2.32.3-1.mga5
libgdk_pixbuf-gir2.0-2.32.3-1.mga5

from gdk-pixbuf2.0-2.32.3-1.mga5.src.rpm

URL: (none) => http://lwn.net/Vulnerabilities/700113/
Version: Cauldron => 5
Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA5TOO => (none)
Severity: normal => major

Comment 3 Lewis Smith 2016-09-16 14:33:16 CEST
Testing Mageia 5 x64 real hardware with AMD/ATI/Radeon graphics

From bug 18476: "To test, make sure Firefox can load images OK."

Updated from version  -2.32.1-1.1 to:
 gdk-pixbuf2.0-2.32.3-1.mga5
 lib64gdk_pixbuf-gir2.0-2.32.3-1.mga5
 lib64gdk_pixbuf2.0_0-2.32.3-1.mga5
 lib64gdk_pixbuf2.0-devel-2.32.3-1.mga5
Using Firefox, looked at a selection of on-line JPEG, GIF & PNG images. Everything seems OK.

CC: (none) => lewyssmith
Whiteboard: (none) => MGA5-64-OK

Comment 4 Len Lawrence 2016-09-23 23:19:18 CEST
Updated gdk-pixbuf packages on i586 virtualbox.

Loaded images in Firefox from astronomical sites and local image directory to test various formats; PNG, JPEG, SVG, GIF, PNG, ICO.  Bitmap images would not load but they probably don't anyway.

This looks OK.

CC: (none) => tarazed25

Len Lawrence 2016-09-23 23:21:57 CEST

Whiteboard: MGA5-64-OK => MGA5-64-OK MGA5-32-OK

Comment 5 Lewis Smith 2016-09-25 09:09:12 CEST
Validating this update; advisory to follow.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 6 Mageia Robot 2016-09-25 17:46:15 CEST
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0322.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.