Log in Start free

Vulnerability · Published Dec 26, 2020 · Assigned by mitre

CVE-2020-29385

Medium 5.5

In plain English

A medium-severity security flaw in the gdk-pixbuf package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)1.5%top 25.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20gdk-pixbuf2.42.2-r0ALPINE-CVE-2020-29385
Alpine:v3.21gdk-pixbuf2.42.2-r0ALPINE-CVE-2020-29385
Alpine:v3.22gdk-pixbuf2.42.2-r0ALPINE-CVE-2020-29385
Alpine:v3.23gdk-pixbuf2.42.2-r0ALPINE-CVE-2020-29385
Alpine:v3.24gdk-pixbuf2.42.2-r0ALPINE-CVE-2020-29385
Debian:12gdk-pixbuf2.42.2+dfsg-1DEBIAN-CVE-2020-29385
Debian:13gdk-pixbuf2.42.2+dfsg-1DEBIAN-CVE-2020-29385
Debian:14gdk-pixbuf2.42.2+dfsg-1DEBIAN-CVE-2020-29385

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References