Updated gdk-pixbuf packages

[mystified]

Mandrakesoft Security Advisories

 

Package name gdk-pixbuf

Date September 15th, 2004

Advisory ID MDKSA-2004:095

Affected versions 9.2, 10.0

Synopsis Updated gdk-pixbuf packages fix image loading vulnerabilities

 

 

Problem Description

 

A vulnerability was found in the gdk-pixbug bmp loader where a bad BMP image could send the bmp loader into an infinite loop (CAN-2004-0753).

 

Chris Evans found a heap-based overflow and a stack-based overflow in the xpm loader of gdk-pixbuf (CAN-2004-0782 and CAN-2004-0783).

 

Chris Evans also discovered an integer overflow in the ico loader of gdk-pixbuf (CAN-2004-0788).

 

All four problems have been corrected in these updated packages.

 

 

Updated Packages

 

 

Mandrakelinux 9.2

 

5b14a4d5b7926db20d436ddbc9991448 9.2/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.92mdk.i586.rpm

aba9d39e7b5dfc2ef8dec18307358f6f 9.2/RPMS/libgdk-pixbuf-gnomecanvas1-0.22.0-2.1.92mdk.i586.rpm

d80cbaf22163a248bd35c6d1b3fac2c3 9.2/RPMS/libgdk-pixbuf-xlib2-0.22.0-2.1.92mdk.i586.rpm

bfe975ea60b0c7bf6556a4c174850676 9.2/RPMS/libgdk-pixbuf2-0.22.0-2.1.92mdk.i586.rpm

0521148ae973bffab1375da9cb91b1ea 9.2/RPMS/libgdk-pixbuf2-devel-0.22.0-2.1.92mdk.i586.rpm

dee3f2d2738f850c79c938df7ac7c8f8 9.2/SRPMS/gdk-pixbuf-0.22.0-2.1.92mdk.src.rpm

 

Mandrakelinux 9.2/AMD64

 

1f1cb7ad69ba3dd98a517370430f74e7 amd64/9.2/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.92mdk.amd64.rpm

59a41e35d449fc6ecc4d3bb061403d25 amd64/9.2/RPMS/lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.1.92mdk.amd64.rpm

76c038a1d28272b6341835dd723ccea2 amd64/9.2/RPMS/lib64gdk-pixbuf-xlib2-0.22.0-2.1.92mdk.amd64.rpm

8a54916d945401bb5c57d6f1e6c525c1 amd64/9.2/RPMS/lib64gdk-pixbuf2-0.22.0-2.1.92mdk.amd64.rpm

48c50fca72679e4643df8ea0b4d0bf39 amd64/9.2/RPMS/lib64gdk-pixbuf2-devel-0.22.0-2.1.92mdk.amd64.rpm

dee3f2d2738f850c79c938df7ac7c8f8 amd64/9.2/SRPMS/gdk-pixbuf-0.22.0-2.1.92mdk.src.rpm

 

Mandrakelinux 10.0

 

f4ffbb227e070e7aace9ff3453c2a9e4 10.0/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.100mdk.i586.rpm

840fb0f158f3b2aa31a0fffd32d61c95 10.0/RPMS/libgdk-pixbuf-gnomecanvas1-0.22.0-2.1.100mdk.i586.rpm

a9d68383ba8d8a1ef6d268f5b1564b5e 10.0/RPMS/libgdk-pixbuf-xlib2-0.22.0-2.1.100mdk.i586.rpm

cdae96796308a0bd13abb2326b6c7d78 10.0/RPMS/libgdk-pixbuf2-0.22.0-2.1.100mdk.i586.rpm

c0b067a672f8e5e0d0d8c3aec3c00c99 10.0/RPMS/libgdk-pixbuf2-devel-0.22.0-2.1.100mdk.i586.rpm

89c3c1a2fe969ccdfda42018375fc64b 10.0/SRPMS/gdk-pixbuf-0.22.0-2.1.100mdk.src.rpm

 

Mandrakelinux 10.0/AMD64

 

bd4abe68b479da8b4bece492660ddd41 amd64/10.0/RPMS/gdk-pixbuf-loaders-0.22.0-2.1.100mdk.amd64.rpm

17eaa5527c3fe0686a3c4e438b619690 amd64/10.0/RPMS/lib64gdk-pixbuf-gnomecanvas1-0.22.0-2.1.100mdk.amd64.rpm

0d70373e01871748ed0cab603d57b497 amd64/10.0/RPMS/lib64gdk-pixbuf-xlib2-0.22.0-2.1.100mdk.amd64.rpm

0254d717bf8124dbd81cd8e0fa7c2c51 amd64/10.0/RPMS/lib64gdk-pixbuf2-0.22.0-2.1.100mdk.amd64.rpm

c4ec20acf29b206c818120cfadfc9d8d amd64/10.0/RPMS/lib64gdk-pixbuf2-devel-0.22.0-2.1.100mdk.amd64.rpm

89c3c1a2fe969ccdfda42018375fc64b amd64/10.0/SRPMS/gdk-pixbuf-0.22.0-2.1.100mdk.src.rpm

 

References

 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0753

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0782

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0783

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0788

 

 

Upgrade

 

 

To upgrade automatically, use MandrakeUpdate.

 

Verification

 

 

Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command:

 

rpm --checksig package.rpm

 

 

You can get the GPG public key of the Mandrakelinux Security Team to verify the GPG signature of each RPM.

 

If you use MandrakeUpdate, the ver