Log in Start free

Vulnerability · Published Jul 24, 2022 · Assigned by mitre

CVE-2021-46829

High 7.8

In plain English

A high-severity security flaw in the gdk-pixbuf2 package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.8%top 43.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit systems.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gdk-pixbuf22.42.6-3.el9ALSA-2023:2216
AlmaLinux:9gdk-pixbuf2-devel2.42.6-3.el9ALSA-2023:2216
AlmaLinux:9gdk-pixbuf2-modules2.42.6-3.el9ALSA-2023:2216
Debian:12gdk-pixbuf2.42.8+dfsg-1DEBIAN-CVE-2021-46829
Debian:13gdk-pixbuf2.42.8+dfsg-1DEBIAN-CVE-2021-46829
Debian:14gdk-pixbuf2.42.8+dfsg-1DEBIAN-CVE-2021-46829

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References