USN-2898-1

It was discovered that GTK+ incorrectly handled certain large images. A remote attacker could use this issue to cause GTK+ applications to crash, resulting in a denial of service, or possibly execute arbitrary code.

References

Affected packages

Ubuntu:14.04:LTS / gtk+2.0

Package

Name: gtk+2.0
Purl: pkg:deb/ubuntu/gtk+2.0@2.24.23-0ubuntu1.4?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.24.23-0ubuntu1.4

Affected versions

2.*

2.24.20-1ubuntu1

2.24.21-1ubuntu1

2.24.22-1ubuntu1

2.24.22-1ubuntu2

2.24.23-0ubuntu1

2.24.23-0ubuntu1.1

2.24.23-0ubuntu1.2

2.24.23-0ubuntu1.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "gir1.2-gtk-2.0",
            "binary_version": "2.24.23-0ubuntu1.4"
        },
        {
            "binary_name": "gtk2-engines-pixbuf",
            "binary_version": "2.24.23-0ubuntu1.4"
        },
        {
            "binary_name": "gtk2.0-examples",
            "binary_version": "2.24.23-0ubuntu1.4"
        },
        {
            "binary_name": "libgail-common",
            "binary_version": "2.24.23-0ubuntu1.4"
        },
        {
            "binary_name": "libgail-dev",
            "binary_version": "2.24.23-0ubuntu1.4"
        },
        {
            "binary_name": "libgail18",
            "binary_version": "2.24.23-0ubuntu1.4"
        },
        {
            "binary_name": "libgtk2.0-0",
            "binary_version": "2.24.23-0ubuntu1.4"
        },
        {
            "binary_name": "libgtk2.0-bin",
            "binary_version": "2.24.23-0ubuntu1.4"
        },
        {
            "binary_name": "libgtk2.0-common",
            "binary_version": "2.24.23-0ubuntu1.4"
        },
        {
            "binary_name": "libgtk2.0-dev",
            "binary_version": "2.24.23-0ubuntu1.4"
        }
    ],
    "availability": "No subscription required"
}