Fluid Attacks Database

Description

Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	gdk-pixbuf	>=0 <0.22.0-7	0.22.0-7
debian 12	gtk+2.0	>=0 <2.4.9-2	2.4.9-2
debian 13	gdk-pixbuf	>=0 <0.22.0-7	0.22.0-7
debian 14	gdk-pixbuf	>=0 <0.22.0-7	0.22.0-7
debian 13	gtk+2.0	>=0 <2.4.9-2	2.4.9-2
debian 14	gtk+2.0	>=0 <2.4.9-2	2.4.9-2
debian 11	gtk+2.0	>=0 <2.4.9-2	2.4.9-2
debian 12	gdk-pixbuf	>=0 <0.22.0-7	0.22.0-7

Aliases

1. CVE-2004-07822. NVD-2004-07823. OSV-DEBIAN-2004-07824. OSV-2004-07825. SECURITY-TRACKER-CVE-2004-0782

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.