CVE-2013-7447
Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allows remote attackers to cause a denial of service…
Does this matter?
Lower severity and a low EPSS score (4.63%). Track it; it rarely justifies an emergency change on its own.
Description
Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allows remote attackers to cause a denial of service (crash) via a large image file, which triggers a large memory allocation.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 4.63% probability · 91th percentile
- CISA KEV
- Not listed
- Affected
- canonical/ubuntu linux · samsung/x14j firmware
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00010.html
- http://www.openwall.com/lists/oss-security/2016/02/10/2
- http://www.openwall.com/lists/oss-security/2016/02/10/6
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.securityfocus.com/bid/83239
- http://www.ubuntu.com/usn/USN-2898-1Vendor Advisory
- http://www.ubuntu.com/usn/USN-2898-2Vendor Advisory
- https://bugs.launchpad.net/ubuntu/+source/gtk+2.0/+bug/1540811
- https://bugzilla.gnome.org/show_bug.cgi?id=703220
- https://git.gnome.org/browse/gtk+/commit?id=894b1ae76a32720f4bb3d39cf460402e3ce331d6
- https://git.gnome.org/browse/gtk+/tree/NEWSPatch
- https://github.com/mate-desktop/eom/issues/93
- http://lists.opensuse.org/opensuse-updates/2016-03/msg00010.html
- http://www.openwall.com/lists/oss-security/2016/02/10/2
- http://www.openwall.com/lists/oss-security/2016/02/10/6
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.securityfocus.com/bid/83239
- http://www.ubuntu.com/usn/USN-2898-1Vendor Advisory
- http://www.ubuntu.com/usn/USN-2898-2Vendor Advisory
- https://bugs.launchpad.net/ubuntu/+source/gtk+2.0/+bug/1540811
- https://bugzilla.gnome.org/show_bug.cgi?id=703220
- https://git.gnome.org/browse/gtk+/commit?id=894b1ae76a32720f4bb3d39cf460402e3ce331d6
- https://git.gnome.org/browse/gtk+/tree/NEWSPatch
- https://github.com/mate-desktop/eom/issues/93
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.