Bugzilla – Bug 74688
VUL-0: CVE-2005-0891: gdk-pixbuf double free
Last modified: 2021-10-27 16:01:01 UTC
We received the following report via vendor-sec.
The issue is public.
If it's not exploitable we probably don't need to fix it right now.
Date: Mon, 28 Mar 2005 09:51:44 -0500
From: Josh Bressers <firstname.lastname@example.org>
Subject: [vendor-sec] [email@example.com: gdk-pixbuf bmp crashes]
This issue was brought to our attention by our gtk maintainer.
It's a double free issue when dealing with BMP issues, but the codepath
seems to be free once, start cleaning up, free again. This leads me to
believe it's just going to be a DoS rather than allow arbitrary code
----- Forwarded message from Matthias Clasen <firstname.lastname@example.org> -----
Subject: gdk-pixbuf bmp crashes
From: Matthias Clasen <email@example.com>
Date: Mon, 28 Mar 2005 09:05:27 -0500
The gdk-pixbuf bmp loader can be tricked into a double free, see
Demo image here:
This probably affects all version of gtk we ship. I haven't checked
if it also affects the standalone gdk-pixbuf package.
The bug http://bugzilla.gnome.org/show_bug.cgi?id=150664
has a collection of valid and invalid bmp test images in an attachment
which we might want to give to QA for checking our other image
----- End forwarded message -----
Vendor Security mailing list
It looks like the impact is limited to a denial-of-service condition and not
being a code execution scenario. I did not find a hint that an attacker is
able to overwrite the internal structures used by glibc for handling dyn.
allocated memory chunks. The glibc implementation of SL 9.2 even catches
double free bugs (unfortunately not safely).
so rather low prio. CAN-2005-0891
also affects gtk2
would you please fix this bug in stable so we can close it?
http://bugzilla.gnome.org/show_bug.cgi?id=171707#c5 backported to gdk-pixbuf.
gtk2 not fixed. It will be updated for sure during 10.0 release cycle to the
CVE-2005-0891: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)