SUSE-SU-2018:2470-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:2470-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2018:2470-1
Related
Published
2018-08-21T12:55:58Z
Modified
2018-08-21T12:55:58Z
Summary
Security update for gtk2
Details

This update for gtk2 provides the following fixes:

These security issues were fixed:

  • CVE-2017-6312: Prevent integer overflow that allowed context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file (bsc#1027026).
  • CVE-2017-6314: The makeavailableat_least function allowed context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file (bsc#1027025).
  • CVE-2017-6313: Prevent integer underflow in the load_resources function that allowed context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via a crafted image entry size in an ICO file (bsc#1027024).
  • CVE-2017-2862: Prevent heap overflow in the gdkpixbufjpegimageloadincrement function. A specially crafted jpeg file could have caused a heap overflow resulting in remote code execution (bsc#1048289)
  • CVE-2017-2870: Prevent integer overflow in the tiffimageparse functionality. A specially crafted tiff file could have caused a heap-overflow resulting in remote code execution (bsc#1048544).

This non-security issue was fixed:

  • Prevent an infinite loop when a window is destroyed while traversed (bsc#1039465).
References

Affected packages

SUSE:Linux Enterprise Software Development Kit 11 SP4 / gtk2

Package

Name
gtk2
Purl
purl:rpm/suse/gtk2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.18.9-0.45.8.1

Ecosystem specific 

{
    "binaries": [
        {
            "gtk2-devel": "2.18.9-0.45.8.1",
            "gtk2-devel-32bit": "2.18.9-0.45.8.1"
        }
    ]
}

SUSE:Linux Enterprise Server 11 SP4 / gtk2

Package

Name
gtk2
Purl
purl:rpm/suse/gtk2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.18.9-0.45.8.1

Ecosystem specific 

{
    "binaries": [
        {
            "gtk2": "2.18.9-0.45.8.1",
            "gtk2-doc": "2.18.9-0.45.8.1",
            "gtk2-32bit": "2.18.9-0.45.8.1",
            "gtk2-x86": "2.18.9-0.45.8.1",
            "gtk2-lang": "2.18.9-0.45.8.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 11 SP4 / gtk2

Package

Name
gtk2
Purl
purl:rpm/suse/gtk2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.18.9-0.45.8.1

Ecosystem specific 

{
    "binaries": [
        {
            "gtk2": "2.18.9-0.45.8.1",
            "gtk2-doc": "2.18.9-0.45.8.1",
            "gtk2-32bit": "2.18.9-0.45.8.1",
            "gtk2-x86": "2.18.9-0.45.8.1",
            "gtk2-lang": "2.18.9-0.45.8.1"
        }
    ]
}