CVE-2020-29385
Medium
Description
GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Gnome Gdk-pixbuf
PublishedDec 26, 2020
First seenDec 26, 2020
How to fix
Update
- gnome gdk-pixbuf2.42.2 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EANWYODLOJDFLMBH6WEKJJMQ5PKLEWML/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5H3GNVWMZTYZR3JBYCK57PF7PFMQBNP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BGZVCTH5O7WBJLYXZ2UOKLYNIFPVR55D/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnome gdk-pixbuf | 2.39.2 < v < 2.42.2 | 2.42.2 |
| canonical ubuntu_linux | 20.04, 20.10 | — |
| fedoraproject fedora | 33, 34 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.