Wind River Support Network

HomeDefectsLIN8-3388

Fixed

LIN8-3388 : Security Advisory - gdk-pixbuf - CVE-2015-7552

Created: Apr 25, 2016 Updated: Dec 3, 2018

Resolved Date: Sep 4, 2016

Found In Version: 8.0

Fix Version: 8.0.0.9

Severity: Standard

Applicable for: Wind River Linux 8

Component/s: Userspace

Description

Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7552

Steps to Reproduce

$configure sato rootfs
$make gdk-pixbuf-dev.addpkg
$make export-sdk
$install SDK
(build application)
${CC} -o gdk-pixbuf-flip gdk-pixbuf-flip.c `pkg-config --cflags glib-2.0` `pkg-config --cflags gdk-pixbuf-2.0` `pkg-config --libs gdk-pixbuf-2.0`
(boot qemu)
$make start-target TOPTS="-in 15 -m 9500"
$./gdk-pixbuf-flip overflow.bmp

Segfault

Other Downloads

CVEs

CVE-2015-7552