[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4FB27485.3000309@redhat.com>
Date: Tue, 15 May 2012 09:21:41 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Sean Amoss <ackle@...too.org>
Subject: Re: CVE Request: gdk-pixbuf Integer overflow in XBM
file loader
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/15/2012 05:50 AM, Sean Amoss wrote:
> Hello,
>
> I have not seen a CVE assigned for this issue yet:
>
> "It's possible to crash any application with memory allocation
> error, or potentially corrupt heap because width/height parameters
> isn't properly verified."
>
>
> References: https://bugs.gentoo.org/show_bug.cgi?id=412033
> https://bugs.launchpad.net/ubuntu/+source/gdk-pixbuf/+bug/681150
>
> Upstream bug: https://bugzilla.gnome.org/show_bug.cgi?id=672811
>
> Upstream commit:
> http://git.gnome.org/browse/gdk-pixbuf/commit/?id=4f0f465f991cd454d03189497f923eb40c170c22
>
>
>
> Thanks, Sean
>
Classic, -1, and this is why we should never trust user input =).
Please use CVE-2012-2370 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJPsnSCAAoJEBYNRVNeJnmT+TUQANXCu7e0gR8iz5udwsUqvopf
uNF3MJWRtsSsZYv98CfYmEVc4sOjw8dMvuROxwQMDXHt2HDl4SmC2CXL5EH/7z/U
05BQlKMSJWSGtqc1k/S0GMyKD590oTOu0T4hexisWBtwEm46vO62EqyyAhhdPcpe
EtYiZZ5HlNIw4w9/W1ypxaIvtO9TYS5F5foNu/x9ltioFuW6AHyImCbOqzyT/18x
AiJrDupLj7DL1NZgRMZx+AuVqt6uaLji1u29WWcQNVUtt7xWWdF5+yuizNUXvSvn
FvPOAMedu/P6k9CzmI1nIfE7fcVh2aV0xzYBG+anyYD4Cl81QaYwfW2B8bCjP4/o
fOi/EgbxmJirbTXH2uBMPY0opa67/0YX7NnNhTEDKH8t7UtI5MoASGZ4CoRVGybw
vnGHiJNEvwkfVjzHxc7CbP7uTvmzZNcDpA8GPtl4pBKW+5AIjQPuvFeOalIRWJ2Z
N+0bxlb1oyBajW1k+Pq9MpzVZ0lfp9DyWNppJuoSKZdxcUCDCePlgP4PjYqBHn36
ey8/M6sR+Fw9rvY+OizeXQVd+daX7jNH5hQho+ZHsyYzwAlPcy3PDpjRJg5Kp/H+
/+qdZraaKcLKtCFld6EkrlyEJVt3383x6D7yqEPFsoMZribkKz5hqo1JjOEqw1lm
QDpSFjq0c4gEAE0CLqyv
=EC1j
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
