We received the following report via vendor-sec.
The issue is public.

If it's not exploitable we probably don't need to fix it right now.

Date: Mon, 28 Mar 2005 09:51:44 -0500
From: Josh Bressers <bressers@redhat.com>
To: vendor-sec@lst.de
Subject: [vendor-sec] [mclasen@redhat.com: gdk-pixbuf bmp crashes]

This issue was brought to our attention by our gtk maintainer.

It's a double free issue when dealing with BMP issues, but the codepath
seems to be free once, start cleaning up, free again.  This leads me to
believe it's just going to be a DoS rather than allow arbitrary code
execution.

-- 
    JB


----- Forwarded message from Matthias Clasen <mclasen@redhat.com> -----

Subject: gdk-pixbuf bmp crashes
From: Matthias Clasen <mclasen@redhat.com>
Date: Mon, 28 Mar 2005 09:05:27 -0500

The gdk-pixbuf bmp loader can be tricked into a double free, see
http://bugzilla.gnome.org/show_bug.cgi?id=171707
Demo image here: 
http://bugzilla.gnome.org/attachment.cgi?id=39270&action=view

This probably affects all version of gtk we ship. I haven't checked
if it also affects the standalone gdk-pixbuf package.

The bug http://bugzilla.gnome.org/show_bug.cgi?id=150664
has a collection of valid and invalid bmp test images in an attachment
(http://bugzilla.gnome.org/attachment.cgi?id=39312&action=view)
which we might want to give to QA for checking our other image
loaders...

Matthias


----- End forwarded message -----
_______________________________________________
Vendor Security mailing list
Vendor Security@lst.de
https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec