Vulnerability · Published Jan 26, 2024 · Assigned by mitre
CVE-2022-48622
High 7.8
In plain English
A high-severity out-of-bounds write in the gdk-pixbuf2 package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | gdk-pixbuf2 | 2.36.12-6.el8_10 | ALSA-2024:3341 |
| AlmaLinux:9 | gdk-pixbuf2 | 2.42.6-4.el9_4 | ALSA-2024:3834 |
| AlmaLinux:8 | gdk-pixbuf2-devel | 2.36.12-6.el8_10 | ALSA-2024:3341 |
| AlmaLinux:9 | gdk-pixbuf2-devel | 2.42.6-4.el9_4 | ALSA-2024:3834 |
| AlmaLinux:8 | gdk-pixbuf2-modules | 2.36.12-6.el8_10 | ALSA-2024:3341 |
| AlmaLinux:9 | gdk-pixbuf2-modules | 2.42.6-4.el9_4 | ALSA-2024:3834 |
| AlmaLinux:8 | gdk-pixbuf2-xlib | 2.36.12-6.el8_10 | ALSA-2024:3341 |
| AlmaLinux:8 | gdk-pixbuf2-xlib-devel | 2.36.12-6.el8_10 | ALSA-2024:3341 |
| Alpine:v3.20 | gdk-pixbuf | 2.42.12-r0 | ALPINE-CVE-2022-48622 |
| Alpine:v3.21 | gdk-pixbuf | 2.42.12-r0 | ALPINE-CVE-2022-48622 |
| Alpine:v3.22 | gdk-pixbuf | 2.42.12-r0 | ALPINE-CVE-2022-48622 |
| Alpine:v3.23 | gdk-pixbuf | 2.42.12-r0 | ALPINE-CVE-2022-48622 |
| Alpine:v3.24 | gdk-pixbuf | 2.42.12-r0 | ALPINE-CVE-2022-48622 |
| Debian:12 | gdk-pixbuf | 2.42.10+dfsg-1+deb12u1 | DEBIAN-CVE-2022-48622 |
| Debian:13 | gdk-pixbuf | 2.42.12+dfsg-1 | DEBIAN-CVE-2022-48622 |
| Debian:14 | gdk-pixbuf | 2.42.12+dfsg-1 | DEBIAN-CVE-2022-48622 |
| Rocky Linux:8 | gdk-pixbuf2 | 0:2.36.12-6.el8_10 | RLSA-2024:3341 |
| Rocky Linux:9 | gdk-pixbuf2 | 0:2.42.6-4.el9_4 | RLSA-2024:3834 |
| Ubuntu:22.04:LTS | gdk-pixbuf | 2.42.8+dfsg-1ubuntu0.3 | USN-6806-1 |
| Ubuntu:22.04:LTS | gdk-pixbuf | 2.42.8+dfsg-1ubuntu0.3 | UBUNTU-CVE-2022-48622 |
| Ubuntu:24.04:LTS | gdk-pixbuf | 2.42.10+dfsg-3ubuntu3.1 | UBUNTU-CVE-2022-48622 |
| Ubuntu:24.04:LTS | gdk-pixbuf | 2.42.10+dfsg-3ubuntu3.1 | USN-6806-1 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H