CVE-2020-29385

GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function writeindexes. if c->selfcode equals 10, self->codetable[10].extends will assign the value 11 to c. The next execution in the loop will assign self->codetable[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.

References

Affected packages

Git / gitlab.gnome.org/GNOME/gdk-pixbuf

Affected ranges

Type

GIT

Repo

https://gitlab.gnome.org/GNOME/gdk-pixbuf

Events

Introduced

Fixed

2518a6817c2b076cdde1d3cc26beb9269a59d725

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.42.2"
        }
    ]
}

Affected versions

2.*

2.21.3

2.21.4

2.21.6

2.21.7

2.22.0

2.22.1

2.23.0

2.23.1

2.23.2

2.23.3

2.23.4

2.23.5

2.24.0

2.25.0

2.25.2

2.26.0

2.26.1

2.26.2

2.26.3

2.26.4

2.26.5

2.27.0

2.27.1

2.27.2

2.27.3

2.28.0

2.29.0

2.29.1

2.29.2

2.29.3

2.30.0

2.30.1

2.30.2

2.30.3

2.30.4

2.30.5

2.30.6

2.30.7

2.30.8

2.31.0

2.31.1

2.31.2

2.31.3

2.31.4

2.31.5

2.31.6

2.31.7

2.32.0

2.32.1

2.33.1

2.33.2

2.34.0

2.35.1

2.35.2

2.35.3

2.35.4

2.35.5

2.36.0

2.36.1

2.36.10

2.36.11

2.36.12

2.36.2

2.36.3

2.36.4

2.36.5

2.36.6

2.36.7

2.36.8

2.36.9

2.37.0

2.37.92

2.38.0

2.39.2

2.40.0

2.42.0

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "20.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "20.10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "33"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "34"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-29385.json"