CVE-2022-48622

In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48622.json"
}

References

Affected packages

Git / gitlab.gnome.org/gnome/gdk-pixbuf

Affected ranges

Type

GIT

Repo

https://gitlab.gnome.org/gnome/gdk-pixbuf

Events

Introduced

Last Affected

9ac257eb38f772fec4253e8051743029e75a2acd

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "2.42.10"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "cpe": "cpe:2.3:a:gnome:gdkpixbuf:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "2.42.10"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

2.*

2.21.3

2.21.4

2.21.6

2.21.7

2.22.0

2.22.1

2.23.0

2.23.1

2.23.2

2.23.3

2.23.4

2.23.5

2.24.0

2.25.0

2.25.2

2.26.0

2.26.1

2.26.2

2.26.3

2.26.4

2.26.5

2.27.0

2.27.1

2.27.2

2.27.3

2.28.0

2.29.0

2.29.1

2.29.2

2.29.3

2.30.0

2.30.1

2.30.2

2.30.3

2.30.4

2.30.5

2.30.6

2.30.7

2.30.8

2.31.0

2.31.1

2.31.2

2.31.3

2.31.4

2.31.5

2.31.6

2.31.7

2.32.0

2.32.1

2.33.1

2.33.2

2.34.0

2.35.1

2.35.2

2.35.3

2.35.4

2.35.5

2.36.0

2.36.1

2.36.10

2.36.11

2.36.12

2.36.2

2.36.3

2.36.4

2.36.5

2.36.6

2.36.7

2.36.8

2.36.9

2.37.0

2.37.92

2.38.0

2.39.2

2.40.0

2.42.0

2.42.10

2.42.2

2.42.4

2.42.6

2.42.8

2.42.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48622.json"