CVE-2021-44648

EUVD-2021-31469
GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
Affected Products (NVD)
VendorProductVersion
gnomegdkpixbuf
2.42.6
debiandebian_linux
11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gdk-pixbuf
bookworm
2.42.10+dfsg-1+deb12u1
fixed
bullseye
2.42.2+dfsg-1+deb11u2
fixed
bullseye (security)
2.42.2+dfsg-1+deb11u1
fixed
buster
not-affected
sid
2.42.12+dfsg-1
fixed
stretch
not-affected
trixie
2.42.12+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gdk-pixbuf
bionic
not-affected
focal
Fixed 2.40.0+dfsg-3ubuntu0.4
released
hirsute
ignored
impish
ignored
jammy
Fixed 2.42.8+dfsg-1ubuntu0.1
released
kinetic
not-affected
trusty
dne
xenial
not-affected
Common Weakness Enumeration
References
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/136
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEVTOGIJITK2N5AOOLKKMDIICZDQE6CH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/
https://sahildhar.github.io/blogpost/GdkPixbuf-Heap-Buffer-Overflow-in-lzw_decoder_new/
https://www.debian.org/security/2022/dsa-5228
https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/136
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEVTOGIJITK2N5AOOLKKMDIICZDQE6CH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/
https://sahildhar.github.io/blogpost/GdkPixbuf-Heap-Buffer-Overflow-in-lzw_decoder_new/
https://www.debian.org/security/2022/dsa-5228