bugtraq - [SECURITY] [DSA 3978-1] gdk-pixbuf security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 18 Sep 2017 22:41:28 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3978-1] gdk-pixbuf security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3978-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
September 18, 2017                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : gdk-pixbuf
CVE ID         : CVE-2017-2862
Debian Bug     : 874552

Marcin Noga discovered a buffer overflow in the JPEG loader of the GDK
Pixbuf library, which may result in the execution of arbitrary code if
a malformed file is opened.

For the oldstable distribution (jessie), this problem has been fixed
in version 2.31.1-2+deb8u6.

For the stable distribution (stretch), this problem has been fixed in
version 2.36.5-2+deb9u1.

We recommend that you upgrade your gdk-pixbuf packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlnALyoACgkQEMKTtsN8
TjaexA//c/rXlBtAH2ZE8s7n3Pea2Wg8LOnEsxeS5/czX4vt/diKRswelaLL4NrZ
HnrMf8SiWs91rvDW39Jx2jnthffOhWrge/RWi7iydJxkEhdLf7PMQUMEflX9CBft
QcHH5RUzaWuT8znq3rhjFX0yLfDm0ZzFF/hTqlyv5ujkbQWt7nirNGZSYlNTPAXi
2LvF8GmjaE1t8kAWpWdFppvW2U6qAcHe1UFR+gnB4tT9/I1RAFVQOXB2MM4ADhbb
kiXV+tE40aZOUiOQcpyfmz3oCdp8b/cVzQFSEUBcquBl4FqvxFmX4/j4vgCu1DAw
LkxSfIcrMq1DXR7jJ5pQUSA2N9KL76S7mu9lYQOlk+jq8Y8xltvxXPnjPFJ0Tqi7
boPiVcvBc+hLIqdPJerP75HsFI+WgMovK+ZB7vRI+Qm00VqUPbaTAjYplh5b3Dfq
SnpC0OCdWL8KXVHO4iYgvjPcurdhvNZjQHBGJdz2XTR92Xzl0aVPH6p1rOvwxzqv
9uqOqQgrUroczdQYQ7Hc0p6z7DoZscyHq76j66BtBC11/fXUM5N6J5CIel5360yf
f5WGaDJLgH/A68y8m1QRMkuCAtqeF2FodHpqUQPSyy+0sCLve6RBTkqi9SCzhWXe
IUynaeHi+BoggbVPXU7g9V7U/z0GWGUzIJHLG6xxdbRo3JlZwAI=
=AohV
-----END PGP SIGNATURE-----