| Name | CVE-2017-2870 |
| Description | An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2043-1, ELA-202-1 |
| Debian Bugs | 873787 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| gdk-pixbuf (PTS) | jessie, jessie (lts) | 2.31.1-2+deb8u10 | fixed |
| stretch (security) | 2.36.5-2+deb9u2 | vulnerable |
| stretch (lts), stretch | 2.36.5-2+deb9u3 | vulnerable |
| buster, buster (lts) | 2.38.1+dfsg-1+deb10u1 | fixed |
| bullseye | 2.42.2+dfsg-1+deb11u2 | fixed |
| bullseye (security) | 2.42.2+dfsg-1+deb11u1 | fixed |
| bookworm | 2.42.10+dfsg-1+deb12u1 | fixed |
| sid, trixie | 2.42.12+dfsg-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[stretch] - gdk-pixbuf <ignored> (Built with GCC in Debian)
https://git.gnome.org/browse/gdk-pixbuf/commit/?id=31a6cff3dfc6944aad4612a9668b8ad39122e48b
https://bugzilla.gnome.org/show_bug.cgi?id=770986
https://bugzilla.gnome.org/show_bug.cgi?id=780269
Built with GCC in Debian, which doesn't remove the check