CVE-2021-44648

GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
gnomegdkpixbuf
2.42.6
debiandebian_linux
11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gdk-pixbuf
bookworm
2.42.10+dfsg-1+deb12u1
fixed
bullseye
2.42.2+dfsg-1+deb11u2
fixed
bullseye (security)
2.42.2+dfsg-1+deb11u1
fixed
buster
not-affected
sid
2.42.12+dfsg-1
fixed
stretch
not-affected
trixie
2.42.12+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gdk-pixbuf
bionic
not-affected
focal
Fixed 2.40.0+dfsg-3ubuntu0.4
released
hirsute
ignored
impish
ignored
jammy
Fixed 2.42.8+dfsg-1ubuntu0.1
released
kinetic
not-affected
trusty
dne
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
gdk-pixbuf-devel
suse enterprise desktop 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise desktop 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise desktop 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise sap 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise sap 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise server 15 SP2
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.3.1
fixed
gdk-pixbuf-lang
suse enterprise desktop 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise desktop 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise desktop 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise sap 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise sap 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise server 15 SP2
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.3.1
fixed
gdk-pixbuf-query-loaders
suse enterprise desktop 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise desktop 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise desktop 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise sap 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise sap 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise server 15 SP2
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.3.1
fixed
gdk-pixbuf-query-loaders-32bit
suse enterprise desktop 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise desktop 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise desktop 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise sap 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise sap 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise server 15 SP2
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.3.1
fixed
gdk-pixbuf-thumbnailer
suse enterprise desktop 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise desktop 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise desktop 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise sap 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise sap 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise server 15 SP2
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.3.1
fixed
libgdk_pixbuf-2_0-0
suse enterprise desktop 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise desktop 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise desktop 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise sap 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise sap 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise server 15 SP2
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.3.1
fixed
libgdk_pixbuf-2_0-0-32bit
suse enterprise desktop 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise desktop 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise desktop 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise sap 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise sap 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise server 15 SP2
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.3.1
fixed
typelib-1_0-GdkPixbuf-2_0
suse enterprise desktop 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise desktop 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise desktop 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise sap 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise sap 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise server 15 SP2
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.3.1
fixed
typelib-1_0-GdkPixdata-2_0
suse enterprise desktop 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise desktop 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise desktop 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise desktop 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise sap 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise sap 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise sap 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise sap 15 SP7
2.42.12-150600.3.3.1
fixed
suse enterprise server 15 SP2
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP3
2.40.0-150200.3.9.1
fixed
suse enterprise server 15 SP4
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP5
2.42.9-150400.5.6.1
fixed
suse enterprise server 15 SP6
2.42.10-150600.1.4
fixed
suse enterprise server 15 SP7
2.42.12-150600.3.3.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
gdk-pixbuf2
RHEL 9
0:2.42.6-3.el9
fixed
gdk-pixbuf2-devel
RHEL 9
0:2.42.6-3.el9
fixed
gdk-pixbuf2-modules
RHEL 9
0:2.42.6-3.el9
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
gdk-pixbuf2
Amazon Linux 2023
0:2.42.10-1.amzn2023.0.1
fixed
gdk-pixbuf2-debuginfo
Amazon Linux 2023
0:2.42.10-1.amzn2023.0.1
fixed
gdk-pixbuf2-debugsource
Amazon Linux 2023
0:2.42.10-1.amzn2023.0.1
fixed
gdk-pixbuf2-devel
Amazon Linux 2023
0:2.42.10-1.amzn2023.0.1
fixed
gdk-pixbuf2-devel-debuginfo
Amazon Linux 2023
0:2.42.10-1.amzn2023.0.1
fixed
gdk-pixbuf2-modules
Amazon Linux 2023
0:2.42.10-1.amzn2023.0.1
fixed
gdk-pixbuf2-modules-debuginfo
Amazon Linux 2023
0:2.42.10-1.amzn2023.0.1
fixed
gdk-pixbuf2-tests
Amazon Linux 2023
0:2.42.10-1.amzn2023.0.1
fixed
gdk-pixbuf2-tests-debuginfo
Amazon Linux 2023
0:2.42.10-1.amzn2023.0.1
fixed
Common Weakness Enumeration
References
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/136
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEVTOGIJITK2N5AOOLKKMDIICZDQE6CH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/
https://sahildhar.github.io/blogpost/GdkPixbuf-Heap-Buffer-Overflow-in-lzw_decoder_new/
https://www.debian.org/security/2022/dsa-5228
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/136
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEVTOGIJITK2N5AOOLKKMDIICZDQE6CH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/
https://sahildhar.github.io/blogpost/GdkPixbuf-Heap-Buffer-Overflow-in-lzw_decoder_new/
https://www.debian.org/security/2022/dsa-5228