CVE-2005-3186
CVSS7.5
发布时间 :2005-11-18 01:03:00
修订时间 :2011-03-07 21:25:59
NMCOPS    

[原文]Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow.


[CNNVD]GTK+ gdk-pixbuf XPM图形渲染库整数溢出漏洞(CNNVD-200511-275)

        GTK+是用于创建图形用户界面的多平台工具包。
        多家厂商的GTK+ gdk-pixbuf XPM图形渲染库实现中存在远程堆溢出漏洞,成功利用这个漏洞的攻击者可以在用户系统上执行任意代码。
        函数库在处理XPM文件时存在整数溢出:
        if (n_col <= 0 || n_col >= G_MAXINT / (cpp + 1)) {
         g_set_error (error,
         GDK_PIXBUF_ERROR,
         GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
         _("XPM file has invalid number of colors"));
         return NULL;
         [...]
         colors = (XPMColor *) g_try_malloc ((sizeof (XPMColor) * n_col));
         [...]
        n_col有效性检查可以防范第一个g_try_malloc中的整数溢出,但没有正确的检查第二个g_try_malloc,这可能导致分配不充分的堆缓冲区,然后在拷贝循环中将n_col用作上边界覆盖缓冲区。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:gtk:gtk%2B:2.4.0
cpe:/a:gnome:gdkpixbuf

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:9503Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file...
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3186
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-3186
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200511-275
(官方数据源) CNNVD

- 其它链接及资源

http://www.redhat.com/support/errata/RHSA-2005-810.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2005:810
http://www.idefense.com/application/poi/display?id=339&type=vulnerabilities
(VENDOR_ADVISORY)  IDEFENSE  20051115 Multiple Vendor GTK+ gdk-pixbuf XPM Loader Heap Overflow Vulnerability
http://www.vupen.com/english/advisories/2005/2433
(UNKNOWN)  VUPEN  ADV-2005-2433
http://www.ubuntu.com/usn/usn-216-1
(UNKNOWN)  UBUNTU  USN-216-1
http://www.securityfocus.com/bid/15435
(UNKNOWN)  BID  15435
http://www.securityfocus.com/archive/1/archive/1/428052/100/0/threaded
(UNKNOWN)  FEDORA  FLSA:173274
http://www.redhat.com/support/errata/RHSA-2005-811.html
(UNKNOWN)  REDHAT  RHSA-2005:811
http://www.novell.com/linux/security/advisories/2005_65_gtk2.html
(UNKNOWN)  SUSE  SUSE-SA:2005:065
http://www.mandriva.com/security/advisories?name=MDKSA-2005:214
(UNKNOWN)  MANDRIVA  MDKSA-2005:214
http://www.gentoo.org/security/en/glsa/glsa-200511-14.xml
(UNKNOWN)  GENTOO  GLSA-200511-14
http://www.debian.org/security/2005/dsa-913
(UNKNOWN)  DEBIAN  DSA-913
http://www.debian.org/security/2005/dsa-911
(UNKNOWN)  DEBIAN  DSA-911
http://support.avaya.com/elmodocs2/security/ASA-2005-229.pdf
(UNKNOWN)  CONFIRM  http://support.avaya.com/elmodocs2/security/ASA-2005-229.pdf
http://securitytracker.com/id?1015216
(UNKNOWN)  SECTRACK  1015216
http://securityreason.com/securityalert/188
(UNKNOWN)  SREASON  188
http://secunia.com/advisories/18509
(UNKNOWN)  SECUNIA  18509
http://secunia.com/advisories/17791
(UNKNOWN)  SECUNIA  17791
http://secunia.com/advisories/17770
(UNKNOWN)  SECUNIA  17770
http://secunia.com/advisories/17710
(UNKNOWN)  SECUNIA  17710
http://secunia.com/advisories/17657
(UNKNOWN)  SECUNIA  17657
http://secunia.com/advisories/17615
(UNKNOWN)  SECUNIA  17615
http://secunia.com/advisories/17594
(UNKNOWN)  SECUNIA  17594
http://secunia.com/advisories/17592
(UNKNOWN)  SECUNIA  17592
http://secunia.com/advisories/17591
(UNKNOWN)  SECUNIA  17591
http://secunia.com/advisories/17588
(UNKNOWN)  SECUNIA  17588
http://secunia.com/advisories/17562
(UNKNOWN)  SECUNIA  17562
http://secunia.com/advisories/17538
(UNKNOWN)  SECUNIA  17538
http://secunia.com/advisories/17522
(UNKNOWN)  SECUNIA  17522
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.8/SCOSA-2006.8.txt
(UNKNOWN)  SCO  SCOSA-2006.8

- 漏洞信息

GTK+ gdk-pixbuf XPM图形渲染库整数溢出漏洞
高危 缓冲区溢出
2005-11-18 00:00:00 2005-11-20 00:00:00
远程  
        GTK+是用于创建图形用户界面的多平台工具包。
        多家厂商的GTK+ gdk-pixbuf XPM图形渲染库实现中存在远程堆溢出漏洞,成功利用这个漏洞的攻击者可以在用户系统上执行任意代码。
        函数库在处理XPM文件时存在整数溢出:
        if (n_col <= 0 || n_col >= G_MAXINT / (cpp + 1)) {
         g_set_error (error,
         GDK_PIXBUF_ERROR,
         GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
         _("XPM file has invalid number of colors"));
         return NULL;
         [...]
         colors = (XPMColor *) g_try_malloc ((sizeof (XPMColor) * n_col));
         [...]
        n_col有效性检查可以防范第一个g_try_malloc中的整数溢出,但没有正确的检查第二个g_try_malloc,这可能导致分配不充分的堆缓冲区,然后在拷贝循环中将n_col用作上边界覆盖缓冲区。

- 公告与补丁

        暂无数据

- 漏洞信息 (F42023)

Debian Linux Security Advisory 913-1 (PacketStormID:F42023)
2005-12-02 00:00:00
Debian  security.debian.org
advisory,vulnerability
linux,debian
CVE-2005-2975,CVE-2005-2976,CVE-2005-3186
[点击下载]

Debian Security Advisory DSA 913-1 - Several vulnerabilities have been found in gdk-pixbuf, the Gtk+ GdkPixBuf XPM image rendering library.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 913-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
December 1st, 2005                      http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : gdk-pixbuf
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE IDs        : CVE-2005-2975 CVE-2005-2976 CVE-2005-3186
BugTraq ID     : 15428
Debian Bug     : 339431

Several vulnerabilities have been found in gdk-pixbuf, the Gtk+
GdkPixBuf XPM image rendering library.  The Common Vulnerabilities and
Exposures project identifies the following problems:

CVE-2005-2975

    Ludwig Nussel discovered an infinite loop when processing XPM
    images that allows an attacker to cause a denial of service via a
    specially crafted XPM file.

CVE-2005-2976

    Ludwig Nussel discovered an integer overflow in the way XPM images
    are processed that could lead to the execution of arbitrary code
    or crash the application via a specially crafted XPM file.

CVE-2005-3186

    "infamous41md" discovered an integer in the XPM processing routine
    that can be used to execute arbitrary code via a traditional heap
    overflow.

The following matrix explains which versions fix these problems:

             old stable (woody)    stable (sarge)   unstable (sid)
gdk-pixbuf     0.17.0-2woody3        0.22.0-8.1       0.22.0-11
gtk+2.0         2.0.2-5woody3         2.6.4-3.1        2.6.10-2

We recommend that you upgrade your gdk-pixbuf packages.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/gdk-pixbuf_0.17.0-2woody3.dsc
      Size/MD5 checksum:      706 148ab895e798cb66959ae0bf7c725424
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/gdk-pixbuf_0.17.0-2woody3.diff.gz
      Size/MD5 checksum:    20031 7851718d740e6e6a629e462b87269234
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/gdk-pixbuf_0.17.0.orig.tar.gz
      Size/MD5 checksum:   547194 021914ad9104f265527c28220315e542

  Alpha architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_alpha.deb
      Size/MD5 checksum:   177066 edf14dd71b77d893ca27c7768dd0a9f4
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_alpha.deb
      Size/MD5 checksum:     9730 52bcd65497f80d9f9b649f2dff012436
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_alpha.deb
      Size/MD5 checksum:     8874 1d7cfd64edf8fc05888e608bbba6edc9
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_alpha.deb
      Size/MD5 checksum:   193844 d20a90a4252d8f9ada81eb07b9798f25

  ARM architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_arm.deb
      Size/MD5 checksum:   156918 7a96bcd45ce4b637283c2b966c1fbbbc
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_arm.deb
      Size/MD5 checksum:     8146 b1081dd21eadff238d9b411a71487759
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_arm.deb
      Size/MD5 checksum:     7282 b65d0f3169de9ff0bd73289de74be475
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_arm.deb
      Size/MD5 checksum:   161486 96ab7f9daf68d8f5317cf8e633e2da29

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_i386.deb
      Size/MD5 checksum:   147604 45fbdaa219558095236d758b15ab8da0
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_i386.deb
      Size/MD5 checksum:     7602 b0d9ed0671ea6b4abc1311c3b50c2821
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_i386.deb
      Size/MD5 checksum:     7142 e125861f4de9b5958e47336332532408
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_i386.deb
      Size/MD5 checksum:   151634 8db98edeeeceddca00ab90d23a3377fd

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_ia64.deb
      Size/MD5 checksum:   194976 de93fe82b55f27ae64566d9946d0fee9
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_ia64.deb
      Size/MD5 checksum:    11016 11b9ec958564155bf58ecef0ce38621f
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_ia64.deb
      Size/MD5 checksum:    11076 d425f1ddd7dda9a2b09816976e365da8
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_ia64.deb
      Size/MD5 checksum:   229474 69ad68e6ed5ea88df1abdf954e26dfa4

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_hppa.deb
      Size/MD5 checksum:   181324 e3543dc0a15a94e57946647fdc777791
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_hppa.deb
      Size/MD5 checksum:     9638 b392986cc6d6ddf24a47589f9fc78b5b
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_hppa.deb
      Size/MD5 checksum:     9316 3be84377508b98df8f700885dc0bcb13
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_hppa.deb
      Size/MD5 checksum:   190026 4741d1df4e66ba1a90758a44a68123ab

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_m68k.deb
      Size/MD5 checksum:   142140 505be04e8005f316259cad3025d599c3
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_m68k.deb
      Size/MD5 checksum:     7306 3967ebf6db8793d6a86fd294af843260
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_m68k.deb
      Size/MD5 checksum:     7016 fb75b5d4d20a3a9f497a154622071d12
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_m68k.deb
      Size/MD5 checksum:   156574 12a13ab0e1bd6aa4557d52e433ce0128

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_mips.deb
      Size/MD5 checksum:   167564 44823af863fa6eaea95bec78a78f3c48
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_mips.deb
      Size/MD5 checksum:     9566 722001dea6d4386afdcaa5503a2734f4
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_mips.deb
      Size/MD5 checksum:     8274 8400f88e4c1ccf9d0a0fc1cdfd160818
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_mips.deb
      Size/MD5 checksum:   165456 e8f367d5b275641cac0dcdb78dd8b847

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_mipsel.deb
      Size/MD5 checksum:   168088 27fe81d3e0d259d0b2f9f1d0cb6b20c3
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_mipsel.deb
      Size/MD5 checksum:     9482 4d21b6c2528e39207b4e161ffc9f8bce
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_mipsel.deb
      Size/MD5 checksum:     8116 5465609ebc24647a0bb8cce0b855c04a
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_mipsel.deb
      Size/MD5 checksum:   165596 9a1e6e006eccecd83d1531e22a5eb69c

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_powerpc.deb
      Size/MD5 checksum:   166132 cda8b87f950b3711955c8e3124ee40e1
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_powerpc.deb
      Size/MD5 checksum:     9246 6823a85cd60349e4ba10e24884a173fd
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_powerpc.deb
      Size/MD5 checksum:     8072 b57e887073c448885cba21df750f7b3c
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_powerpc.deb
      Size/MD5 checksum:   171316 d343436d579fbb1a359e076b84480114

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_s390.deb
      Size/MD5 checksum:   153500 4e03bafc909b4461adead1162b7b2621
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_s390.deb
      Size/MD5 checksum:     7866 20eb416547214564d687c6e1b6dc0d81
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_s390.deb
      Size/MD5 checksum:     7564 bc0b59ddcb29b96cbbe839d881a419e2
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_s390.deb
      Size/MD5 checksum:   167510 59c3f71ee91508e678a66bf28c983f82

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.17.0-2woody3_sparc.deb
      Size/MD5 checksum:   161136 aa671663e7343c7f7f8b47960b558f11
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.17.0-2woody3_sparc.deb
      Size/MD5 checksum:     8270 2f7862d0a6f2f98b0d4c6e3e0b6929df
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.17.0-2woody3_sparc.deb
      Size/MD5 checksum:     7502 97aac947b5168472b1ab4a6a0399d1c1
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.17.0-2woody3_sparc.deb
      Size/MD5 checksum:   167184 9d79c42f3dcba5026069b15e742aafdd


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0-8.1.dsc
      Size/MD5 checksum:      709 7a800a91469430a28ab1900ebb92ba83
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0-8.1.diff.gz
      Size/MD5 checksum:   372331 20d149f93e8093e4dbb365e9278ce741
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0.orig.tar.gz
      Size/MD5 checksum:   519266 4db0503b5a62533db68b03908b981751

  Alpha architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_alpha.deb
      Size/MD5 checksum:   185780 fbfdd560a6b3591165a757797198e931
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_alpha.deb
      Size/MD5 checksum:    10376 3b5273e0e21ee40c5d540a22ff91b99a
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_alpha.deb
      Size/MD5 checksum:     8650 c5d672403f8038129d35022515e8a339
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_alpha.deb
      Size/MD5 checksum:   205704 22b1261a845cea95520acd68cf6e74ec

  AMD64 architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_amd64.deb
      Size/MD5 checksum:   155358 8653e4d9403ff7baeefbc7c955b83eb7
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_amd64.deb
      Size/MD5 checksum:     8474 ffad5870291f93584f70fa7645b54bdd
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_amd64.deb
      Size/MD5 checksum:     7942 d32005b5de994f10f15dfb91a6caf507
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_amd64.deb
      Size/MD5 checksum:   183366 6304fdc084b9e2ec433712b091e497c5

  ARM architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_arm.deb
      Size/MD5 checksum:   153978 e13ef5dd0694f3d0cc5836d2fdbddec0
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_arm.deb
      Size/MD5 checksum:     8126 4ef59c62c86c0d567929d0e88fd4ebb9
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_arm.deb
      Size/MD5 checksum:     7076 ccc7721296431294a6a657ec5c4bf2a7
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_arm.deb
      Size/MD5 checksum:   171352 afe13217c5566e0ecf26950bc9b2f4b5

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_i386.deb
      Size/MD5 checksum:   150416 0f2d4af07ce624a4fa3af2e0964e91a3
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_i386.deb
      Size/MD5 checksum:     7860 4e0d60fa4cebefe5c434fbe2e5bf16e6
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_i386.deb
      Size/MD5 checksum:     7354 3b6d8fc4ebc1314a35c307dd51ec1e1f
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_i386.deb
      Size/MD5 checksum:   172140 0f6b383d15e21f02a9db0f3b58d31864

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_ia64.deb
      Size/MD5 checksum:   196584 25c9be6f81524a4641c8b7faf3f14b48
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_ia64.deb
      Size/MD5 checksum:    10860 a04397bc288e8abe6f8094ac5cdfc8a8
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_ia64.deb
      Size/MD5 checksum:    10544 97dec60626ea52e0ce3adf5df0619228
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_ia64.deb
      Size/MD5 checksum:   232546 973a9a9a079936e682fe352dfb2eae0a

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_hppa.deb
      Size/MD5 checksum:   173056 0960b569e9cc3c6533e4a2394b56b18a
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_hppa.deb
      Size/MD5 checksum:     9238 5699f6b933217187a165956a4adcf8c9
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_hppa.deb
      Size/MD5 checksum:     9070 e82facecfb3184345b797176110c8795
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_hppa.deb
      Size/MD5 checksum:   201596 df67a873b1f1781b5418479802780074

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_m68k.deb
      Size/MD5 checksum:   137808 855cd148e584d2a47e15b893bc771076
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_m68k.deb
      Size/MD5 checksum:     7114 1c2ffc6287c76e8b656ac4cc8cb45197
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_m68k.deb
      Size/MD5 checksum:     6822 b23f138f206443979bef0f0d16429e9f
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_m68k.deb
      Size/MD5 checksum:   168122 fec535c555ffcec871f015251bb5d392

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_mips.deb
      Size/MD5 checksum:   166212 c3648e5b7be69cb95dd162d1532a4064
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_mips.deb
      Size/MD5 checksum:     9512 c4b9a6a610d879af5986eabeb819bd44
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_mips.deb
      Size/MD5 checksum:     8084 af031e50f98a270977aac6d3f60c37aa
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_mips.deb
      Size/MD5 checksum:   178910 0538e2bfe12f9fcd0d9b391adc4ca403

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_mipsel.deb
      Size/MD5 checksum:   167032 2739863166ce8ccdd7a289e47ce94e8f
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_mipsel.deb
      Size/MD5 checksum:     9544 cdd63315a97c0ff14fa6982811d25ac4
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_mipsel.deb
      Size/MD5 checksum:     8058 a7fee13884e082a5c0646c6723e757f4
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_mipsel.deb
      Size/MD5 checksum:   180220 d15b93b2235a05eeba9ab2fdce88327e

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_powerpc.deb
      Size/MD5 checksum:   163132 8562f340ba8cba0079fa6c36a5c3a384
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_powerpc.deb
      Size/MD5 checksum:     9170 cd1fe56377a4313d54bbce1622c5f10f
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_powerpc.deb
      Size/MD5 checksum:     9526 c9f4119ba2c4b9b2a00fd0b44b01358c
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_powerpc.deb
      Size/MD5 checksum:   192594 3adc981ada6481239fc3c61af7781da2

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_s390.deb
      Size/MD5 checksum:   164994 c92cd17bdead77f5ab59a314208d07ea
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_s390.deb
      Size/MD5 checksum:     8168 e4bce7d526b10a608e6238d0fb602131
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_s390.deb
      Size/MD5 checksum:     7802 551bdf573b50cff118ff68360a249630
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_s390.deb
      Size/MD5 checksum:   184668 d0917c0875e16ab54637f1ac1c299208

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8.1_sparc.deb
      Size/MD5 checksum:   155602 8c2980db112716debc75371df0ae3e3a
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8.1_sparc.deb
      Size/MD5 checksum:     8130 462d2e5c734a69f942dd73d67224f3d4
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8.1_sparc.deb
      Size/MD5 checksum:     7304 4935a0b91d3056e28b8375d99a13181c
    http://security.debian.org/pool/updates/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8.1_sparc.deb
      Size/MD5 checksum:   174592 93b600efa8160007aa687eb67b63b141


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDjo7qW5ql+IAeqTIRAqciAKCZNDHd9wXe3TUrQovShloWXfGAwACgsOcF
7cftY3TvKmE5biVTmaDRWJM=
=7/15
-----END PGP SIGNATURE-----

    

- 漏洞信息 (F42011)

Debian Linux Security Advisory 911-1 (PacketStormID:F42011)
2005-12-02 00:00:00
Debian  security.debian.org
advisory,vulnerability
linux,debian
CVE-2005-2975,CVE-2005-2976,CVE-2005-3186
[点击下载]

Debian Security Advisory DSA 911-1 - Several vulnerabilities have been found in gtk+2.0, the Gtk+ GdkPixBuf XPM image rendering library.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 911-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
November 29th, 2005                     http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : gtk+2.0
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE IDs        : CVE-2005-2975 CVE-2005-2976 CVE-2005-3186
BugTraq ID     : 15428
Debian Bug     : 339431

Several vulnerabilities have been found in gtk+2.0, the Gtk+ GdkPixBuf
XPM image rendering library.  The Common Vulnerabilities and Exposures
project identifies the following problems:

CVE-2005-2975

    Ludwig Nussel discovered an infinite loop when processing XPM
    images that allows an attacker to cause a denial of service via a
    specially crafted XPM file.

CVE-2005-2976

    Ludwig Nussel discovered an integer overflow in the way XPM images
    are processed that could lead to the execution of arbitrary code
    or crash the application via a specially crafted XPM file.

CVE-2005-3186

    "infamous41md" discovered an integer in the XPM processing routine
    that can be used to execute arbitrary code via a traditional heap
    overflow.

The following matrix explains which versions fix these problems:

             old stable (woody)    stable (sarge)   unstable (sid)
gdk-pixbuf     0.17.0-2woody3        0.22.0-8.1       0.22.0-11
gtk+2.0         2.0.2-5woody3         2.6.4-3.1        2.6.10-2

We recommend that you upgrade your gtk+2.0 packages.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk+2.0_2.0.2-5woody3.dsc
      Size/MD5 checksum:      863 2c19c0b3843d6003e5561830e80aec28
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk+2.0_2.0.2-5woody3.diff.gz
      Size/MD5 checksum:    48155 4035c2ee98fd6c0dde2c6d73d252c6e4
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk+2.0_2.0.2.orig.tar.gz
      Size/MD5 checksum:  7835836 dc80381b84458d944c5300a1672c099c

  Architecture independent components:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-doc_2.0.2-5woody3_all.deb
      Size/MD5 checksum:  1379440 c1501024119c24ed506990384e52c660

  Alpha architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_alpha.deb
      Size/MD5 checksum:   221376 ed09b3dbbed147b7be1820048f832593
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_alpha.deb
      Size/MD5 checksum:     1104 ed3650ca259b534fc67c03a833a6a6f7
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_alpha.deb
      Size/MD5 checksum:  1586026 7bda54cc76e8eefbb2395f397d3cc7c6
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_alpha.deb
      Size/MD5 checksum:   595890 eca337b48cb5c2894bec95b0765ba65e
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_alpha.deb
      Size/MD5 checksum:  5878258 5ea4f1fad5efe6d3344bfc13b3addc65
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_alpha.deb
      Size/MD5 checksum:   178326 285885ccfc39722d26950f0bada6c867

  ARM architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_arm.deb
      Size/MD5 checksum:   215182 5be1bc9cfaa8086536f6e3a165fd930e
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_arm.deb
      Size/MD5 checksum:     1100 0a29371fc6cac98e6545ff12b76d7847
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_arm.deb
      Size/MD5 checksum:  1420128 02ddea0ef1473ea7775d912fb1e3b91c
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_arm.deb
      Size/MD5 checksum:   595368 ff659a4540d523aac34decb6eff1f297
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_arm.deb
      Size/MD5 checksum:  2903986 02aa5794bcfa4aa9599f7ce6f28f8d6d
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_arm.deb
      Size/MD5 checksum:   177280 309dd451617141fb027c9bcd033790ea

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_i386.deb
      Size/MD5 checksum:   215480 c82e1af319f9f5949caab2938717b8e4
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_i386.deb
      Size/MD5 checksum:     1106 9d59680c9fa9ba60219f296d7959726b
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_i386.deb
      Size/MD5 checksum:  1289508 e353ab4cf8ba7d8d3a85948d7160ce99
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_i386.deb
      Size/MD5 checksum:   595390 82104b484be3b874e0af857cb37a790b
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_i386.deb
      Size/MD5 checksum:  2722172 be34f43c3d39e4df7c9ac4ec558d8e75
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_i386.deb
      Size/MD5 checksum:   177124 0c6e637485b5925c10180483ed989ba4

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_ia64.deb
      Size/MD5 checksum:   231234 1ca5b216a2567c33ac780304dba4be5d
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_ia64.deb
      Size/MD5 checksum:     1100 15327d5515c0d1a161cc5b61b86b22ce
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_ia64.deb
      Size/MD5 checksum:  2077588 901d4767fb27fe07d7ed13725ccdd2b8
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_ia64.deb
      Size/MD5 checksum:   596730 fd38392178172446f0bc716061be5209
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_ia64.deb
      Size/MD5 checksum:  9450266 a17f9d4a6dab77314a1b93549f10a3bd
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_ia64.deb
      Size/MD5 checksum:   178702 a1f72b3672cd240cd911d6b3a451f80e

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_hppa.deb
      Size/MD5 checksum:   220956 edd51b44537f51e470d8b2943c309952
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_hppa.deb
      Size/MD5 checksum:     1108 314dabcc5226bce8f63a8df5a252b584
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_hppa.deb
      Size/MD5 checksum:  1718118 ca53b11b4294c94ff8c4f9f72437b6e7
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_hppa.deb
      Size/MD5 checksum:   595688 50571f1e4793bdc9e169132defa1693a
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_hppa.deb
      Size/MD5 checksum:  3317050 fef66e14343d589e06cb244b6374bb38
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_hppa.deb
      Size/MD5 checksum:   177778 718d0b01ad8a46e50dd28b7999a84231

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_m68k.deb
      Size/MD5 checksum:   215174 2fb7d0afdfac137895e5fb343f6861f9
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_m68k.deb
      Size/MD5 checksum:     1106 fac1df7c4af7bc5b21680a3a6644ce67
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_m68k.deb
      Size/MD5 checksum:  1331670 f55e5b35c28b2639eb13dc9bb32f1347
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_m68k.deb
      Size/MD5 checksum:   595384 b36ebd35c01f490348ed9817079700d6
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_m68k.deb
      Size/MD5 checksum:  2833584 c18bb1755fb31d6da4f8093fe3c03060
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_m68k.deb
      Size/MD5 checksum:   177022 a159f5a1121c260673aee75b2e5bea2d

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_mips.deb
      Size/MD5 checksum:   216496 c38396a00cb755ddaddc8047329a664a
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_mips.deb
      Size/MD5 checksum:     1104 23407e61f23a3021ebd5871871013773
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_mips.deb
      Size/MD5 checksum:  1384584 f740703f3077ecfce8c41f264a63cf1a
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_mips.deb
      Size/MD5 checksum:   595738 0ae33fcedb001ade8548419a11492707
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_mips.deb
      Size/MD5 checksum:  4934158 4289111f54a5c6023dfe37b081a8a22a
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_mips.deb
      Size/MD5 checksum:   177506 e9f92a71bd505feb58ffe7e131e4244e

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_mipsel.deb
      Size/MD5 checksum:   216170 16933f5e26cf8aa335958943e4a8bd98
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_mipsel.deb
      Size/MD5 checksum:     1104 23657699ac0cced8d77adb7baffe1e78
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_mipsel.deb
      Size/MD5 checksum:  1375132 9d605722fdab1a9dd5f9830af7da0e67
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_mipsel.deb
      Size/MD5 checksum:   595706 648f12a77e737b06e14797407f6617ca
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_mipsel.deb
      Size/MD5 checksum:  4789004 398536470f317e5e2d3f50fdfaab1bc5
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_mipsel.deb
      Size/MD5 checksum:   177480 12f2e0288223289532430e4c96f76fd2

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_powerpc.deb
      Size/MD5 checksum:   215246 bac105a786f6085110017cbfbc001ffb
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_powerpc.deb
      Size/MD5 checksum:     1106 2e1df3200d2fa60f1480e8a62515d50d
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_powerpc.deb
      Size/MD5 checksum:  1505610 9560968696c020d1d4b0d76fa07844d0
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_powerpc.deb
      Size/MD5 checksum:   595432 12b496e50c8bd7c822d0e05fa378f6df
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_powerpc.deb
      Size/MD5 checksum:  2980722 d112daa322581d876b7875f05f02aeca
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_powerpc.deb
      Size/MD5 checksum:   177308 b192c4a7e154ac33571a0c0b31a2f5ac

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_s390.deb
      Size/MD5 checksum:   218074 f82c50d7854a0b52005d702f6f969d64
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_s390.deb
      Size/MD5 checksum:     1102 43c949763c6a96d0e6cb9ec1f24c388d
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_s390.deb
      Size/MD5 checksum:  1447638 47636343d961b7a0a64c006dd97a15a2
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_s390.deb
      Size/MD5 checksum:   595634 097a1c2b9090ede08fd57cd7c4b7c0bd
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_s390.deb
      Size/MD5 checksum:  3004574 56fbb2eb95210ce8547ccbaab380df19
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_s390.deb
      Size/MD5 checksum:   177374 d6e449c54fa3ae768932382b09801ed8

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.0.2-5woody3_sparc.deb
      Size/MD5 checksum:   216190 70d05edded855a56b8ed92b735a54e1b
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk-common_2.0.2-5woody3_sparc.deb
      Size/MD5 checksum:     1104 35d308fd4d0171f8363f09cfce189f63
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.0.2-5woody3_sparc.deb
      Size/MD5 checksum:  1434226 7b892592d104c9965240d6ac66bca9ba
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.0.2-5woody3_sparc.deb
      Size/MD5 checksum:   595324 1392262c2a82832aae38b5c78f04f3bb
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dbg_2.0.2-5woody3_sparc.deb
      Size/MD5 checksum:  2872174 6ead4c78c5cc9c008cd4f05ab3823ba3
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.0.2-5woody3_sparc.deb
      Size/MD5 checksum:   177182 2be94de14832d7bf602c942fea220204


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk+2.0_2.6.4-3.1.dsc
      Size/MD5 checksum:     2000 876d42d456f4c65949fe326d4603d0a6
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk+2.0_2.6.4-3.1.diff.gz
      Size/MD5 checksum:    49387 743d43246b74d208e704b0a8212625df
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk+2.0_2.6.4.orig.tar.gz
      Size/MD5 checksum: 16354198 a3ab72c9c80384fb707b992eb8b43c13

  Architecture independent components:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-common_2.6.4-3.1_all.deb
      Size/MD5 checksum:  2983652 b84d91a0e62bc5294208e39a10d8f875
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-doc_2.6.4-3.1_all.deb
      Size/MD5 checksum:  2317798 2b12f72ddc801222745fba5784f0d30a

  Alpha architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_alpha.deb
      Size/MD5 checksum:    62274 8efa86fa72b71c8e1ffdcf569bdd3bf9
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_alpha.deb
      Size/MD5 checksum:   268572 aa3ae47b77c14ae4e1763c8199994264
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_alpha.deb
      Size/MD5 checksum:  2463284 b46cb55a251b626f39c88484175a4eda
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_alpha.deb
      Size/MD5 checksum: 17691386 e42711f63e75be8961dd277a882c6331
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_alpha.deb
      Size/MD5 checksum:    20884 a150efa24ea5521aac282fb289f7cb90
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_alpha.deb
      Size/MD5 checksum:  8475038 57a1cdf6dd1a43188bdab145f472ee75

  AMD64 architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_amd64.deb
      Size/MD5 checksum:    55272 4807db987b4f1ae1a1ce83f995e15b85
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_amd64.deb
      Size/MD5 checksum:   263204 ec67df85400b5970d1d983928537e5cf
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_amd64.deb
      Size/MD5 checksum:  2199236 84e0e79ee05b3f8368e28a3f7566df45
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_amd64.deb
      Size/MD5 checksum: 17653866 b0c569bd51812ed574e59095637d6e73
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_amd64.deb
      Size/MD5 checksum:    19672 6909052aa7ba8ee968b58b8e89bf2388
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_amd64.deb
      Size/MD5 checksum:  7615034 65cf59aefee1022990492a18d4a132ab

  ARM architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_arm.deb
      Size/MD5 checksum:    52910 b44bfd00c91685e787729ab6e3f7e9a6
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_arm.deb
      Size/MD5 checksum:   255640 1e9e352aeaf2652cfe18dcfa69668543
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_arm.deb
      Size/MD5 checksum:  2042744 f23c0f10108b093dd7159f2fc250f54e
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_arm.deb
      Size/MD5 checksum: 17599402 b2db72cde1646ff9c137db8d4c519e86
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_arm.deb
      Size/MD5 checksum:    18138 f77d55c822f498beefb001ec9cc469fa
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_arm.deb
      Size/MD5 checksum:  7478104 89254e98a3da4f85de96a84b927cbde9

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_i386.deb
      Size/MD5 checksum:    51142 54ac82ff996e06087721a12edca85ca0
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_i386.deb
      Size/MD5 checksum:   260184 9562defc5dd5d78d3eac97ac79c0f1b6
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_i386.deb
      Size/MD5 checksum:  2097270 8dedb3a4d88d4aeb64f0b3be221b25e2
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_i386.deb
      Size/MD5 checksum: 17534636 1f90e641d602fb9aef7233c8f2fdc374
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_i386.deb
      Size/MD5 checksum:    18194 eb658bed31f5fa07d5ac7fe194dbd50e
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_i386.deb
      Size/MD5 checksum:  7234930 bb53cc8a482cf455ea1b0c913d6cd2cb

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_ia64.deb
      Size/MD5 checksum:    68508 d73110728702e8c59323435310b78aa2
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_ia64.deb
      Size/MD5 checksum:   276954 94f3ec8cdf10daa527e65993f39834ad
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_ia64.deb
      Size/MD5 checksum:  2894720 05a6507d6de9eaebd36168a293b8077d
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_ia64.deb
      Size/MD5 checksum: 17741224 ad54e2f45926cd52618f0eecdd9ebe34
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_ia64.deb
      Size/MD5 checksum:    22406 bc869ec76246419c8d0921b8cd79942b
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_ia64.deb
      Size/MD5 checksum:  8622734 06e087a2328df617cc742e301df62753

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_hppa.deb
      Size/MD5 checksum:    60060 99a7e167fcba943ebeff9f4268055623
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_hppa.deb
      Size/MD5 checksum:   263712 2cbbaede3e2498c6a7a27cf6b36186e2
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_hppa.deb
      Size/MD5 checksum:  2464528 bbf763c89d4f57fcd9e00b679d5d28ac
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_hppa.deb
      Size/MD5 checksum: 17801132 f1ee34b603b0fd82d0f5c884a80b65c3
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_hppa.deb
      Size/MD5 checksum:    19744 13930708ce9c937d039755ee09a65324
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_hppa.deb
      Size/MD5 checksum:  8408548 321bc004724d528e249865c03a4e6aab

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_m68k.deb
      Size/MD5 checksum:    47752 8721dd7e1931aefd72ff6c23e667355a
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_m68k.deb
      Size/MD5 checksum:   255414 b8e6fd4222ca20dec668bfab34024211
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_m68k.deb
      Size/MD5 checksum:  2045046 a74b3ecc5d12d6566bb3def13eea2ee4
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_m68k.deb
      Size/MD5 checksum: 17822784 dccea1d9ae943c4efaf1f556c5e7d16c
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_m68k.deb
      Size/MD5 checksum:    18100 e2fcdfba8eae770d0d091a16147b02be
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_m68k.deb
      Size/MD5 checksum:  7584802 a8f06db2e97fdca5d7131641cb87e6fc

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_mips.deb
      Size/MD5 checksum:    55698 2e233ae546e0e6bd0b0b0acdb97dc280
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_mips.deb
      Size/MD5 checksum:   259924 3290adf3c203e0d44ba2a80f8bbb4f6e
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_mips.deb
      Size/MD5 checksum:  2122598 205e050434251cc386a5ed78f1be4dec
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_mips.deb
      Size/MD5 checksum: 17885036 ef05b92517ee66fea11ad51e8737d9b6
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_mips.deb
      Size/MD5 checksum:    22858 58f33e26cba9e2c570aa3f71c4a86d1b
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_mips.deb
      Size/MD5 checksum:  8298762 f5eb185ce2ff53a530ee35b7aadd0d69

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_mipsel.deb
      Size/MD5 checksum:    55630 3ffbc3c391c376a88b59127dbd3d9811
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_mipsel.deb
      Size/MD5 checksum:   259836 605358dfcd79e6d26af498a71266df91
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_mipsel.deb
      Size/MD5 checksum:  2123080 91894a08c3dc6607e27c373281b6d9c8
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_mipsel.deb
      Size/MD5 checksum: 17651848 1db2645552e19d37204c58a671ef89b6
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_mipsel.deb
      Size/MD5 checksum:    22924 d6f5ba287f9569a3c45d14253895cf22
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_mipsel.deb
      Size/MD5 checksum:  7745414 985800b5a5e3ffab531efefa2b896d2b

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_powerpc.deb
      Size/MD5 checksum:    56914 ab390a6e0de776bfe600d9fda732152a
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_powerpc.deb
      Size/MD5 checksum:   260204 e89efb3f0c1b01d1230efbf4e40c7e8b
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_powerpc.deb
      Size/MD5 checksum:  2187944 66fc71b309ffa82890c607cd99a4fdf2
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_powerpc.deb
      Size/MD5 checksum: 28593970 dc9734cbb0718815e33808ca4f82a143
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_powerpc.deb
      Size/MD5 checksum:    22188 1e9a28597a9b214424878199b40e9fef
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_powerpc.deb
      Size/MD5 checksum:  8260248 d9407df720a9bc7ebfdfea5e9be20a2d

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_s390.deb
      Size/MD5 checksum:    55302 5a77b24f45d5a31c0cdd4ad24a3e0666
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_s390.deb
      Size/MD5 checksum:   262564 75f285e192a63e8342fcd59f7e4b503f
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_s390.deb
      Size/MD5 checksum:  2294784 4781127b291fe5ece91dc62c32f89757
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_s390.deb
      Size/MD5 checksum: 18179652 087628d587f2c29d5a996778d99f1352
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_s390.deb
      Size/MD5 checksum:    19580 002d9074502272e35fb17f26cd1497a1
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_s390.deb
      Size/MD5 checksum:  8354106 f86a8301975bbd943bba7af3bb625ae3

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-3.1_sparc.deb
      Size/MD5 checksum:    50952 0670511a0028098bb2b7e8a91d195220
    http://security.debian.org/pool/updates/main/g/gtk+2.0/gtk2.0-examples_2.6.4-3.1_sparc.deb
      Size/MD5 checksum:   256562 d35492a1f6de84c96ea0f31ebf250c4c
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0_2.6.4-3.1_sparc.deb
      Size/MD5 checksum:  2137976 d2d31e848e05dc062336f80d3bdb310a
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-3.1_sparc.deb
      Size/MD5 checksum: 17714380 0ae0a52d3c00e951b1b9d737d94d19a5
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-3.1_sparc.deb
      Size/MD5 checksum:    17894 b9628edefc91fa4101780b56c69c86a8
    http://security.debian.org/pool/updates/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-3.1_sparc.deb
      Size/MD5 checksum:  7951126 87b73953c3fa278472e0b4150c160326


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDjHaQW5ql+IAeqTIRAlMLAKCAekILuNT3EybPcdy7e2mx799J8ACgrS3N
77qFF4Y0NUfb3lc3o3fYIRo=
=VBiG
-----END PGP SIGNATURE-----

    

- 漏洞信息 (F41663)

Ubuntu Security Notice 216-1 (PacketStormID:F41663)
2005-11-20 00:00:00
Ubuntu  security.ubuntu.com
advisory,overflow,arbitrary
linux,ubuntu
CVE-2005-2975,CVE-2005-2976,CVE-2005-3186
[点击下载]

Ubuntu Security Notice USN-216-1 - Two integer overflows have been discovered in the XPM image loader of the GDK pixbuf library. By tricking an user into opening a specially crafted XPM image with any Gnome desktop application that uses this library, this could be exploited to execute arbitrary code with the privileges of the user running the application. Additionally, specially crafted XPM images could cause an endless loop in the image loader, which could be exploited to cause applications trying to open that image to hang.

===========================================================
Ubuntu Security Notice USN-216-1	  November 16, 2005
gtk+2.0, gdk-pixbuf vulnerabilities
CVE-2005-2975, CVE-2005-2976, CVE-2005-3186
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
Ubuntu 5.10 (Breezy Badger)

The following packages are affected:

gtk2-engines-pixbuf
libgdk-pixbuf2

The problem can be corrected by upgrading the affected package to
the following versions:

Ubuntu 4.10:
  libgdk-pixbuf2: 0.22.0-7ubuntu1.2
  gtk2-engines-pixbuf: 2.6.4-0ubuntu3.1

Ubuntu 5.04:
  libgdk-pixbuf2: 0.22.0-7ubuntu2.1
  gtk2-engines-pixbuf: 2.6.4-0ubuntu3.1

Ubuntu 5.10:
  libgdk-pixbuf2: 0.22.0-8ubuntu0.1
  gtk2-engines-pixbuf: 2.8.6-0ubuntu2.1

After a standard system upgrade you should restart your session to
effect the necessary changes.

Details follow:

Two integer overflows have been discovered in the XPM image loader of
the GDK pixbuf library. By tricking an user into opening a specially
crafted XPM image with any Gnome desktop application that uses this
library, this could be exploited to execute arbitrary code with the
privileges of the user running the application.
(CVE-2005-2976, CVE-2005-3186)

Additionally, specially crafted XPM images could cause an endless loop
in the image loader, which could be exploited to cause applications
trying to open that image to hang. (CVE-2005-2975)


Updated packages for Ubuntu 4.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0-7ubuntu1.2.diff.gz
      Size/MD5:   375968 809e328e7978a1a05c363744b669a40e
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0-7ubuntu1.2.dsc
      Size/MD5:      723 6c4495f57699b76148a0602927545e20
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0.orig.tar.gz
      Size/MD5:   519266 4db0503b5a62533db68b03908b981751
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk+2.0_2.4.10-1ubuntu1.2.diff.gz
      Size/MD5:    49509 0ce4ae3ba4a43acaec0e267593c56400
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk+2.0_2.4.10-1ubuntu1.2.dsc
      Size/MD5:     1936 dde6d8e7ba7c47e843a5dc8c2b680499
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk+2.0_2.4.10.orig.tar.gz
      Size/MD5: 14140860 b1876ebde3b85bceb576ee5e2ecfd60b

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-common_2.4.10-1ubuntu1.2_all.deb
      Size/MD5:  2778618 00f15aa5dba52503adaf47cede461b2c
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-doc_2.4.10-1ubuntu1.2_all.deb
      Size/MD5:  1877958 bd501df1b60309f472ad33ee74200584

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gtk+2.0/gtk2.0-examples_2.4.10-1ubuntu1.2_amd64.deb
      Size/MD5:   262178 27831fe024d2d09ac5f3c9c457ae0032
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-7ubuntu1.2_amd64.deb
      Size/MD5:   155374 c617a31cf7408ff7ccc6dcf544e766a1
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-7ubuntu1.2_amd64.deb
      Size/MD5:     8520 09e152c4a295c6b3b6e52375e0355e43
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-7ubuntu1.2_amd64.deb
      Size/MD5:     7936 baecd3a2aca1cb678e652782da890483
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-7ubuntu1.2_amd64.deb
      Size/MD5:   183498 080cdd7e1cb08979fc0140a191baf418
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0_2.4.10-1ubuntu1.2_amd64.deb
      Size/MD5:  2184102 04a8f1b3e01bf5618f5d8b70645be6bb
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-bin_2.4.10-1ubuntu1.2_amd64.deb
      Size/MD5:    13932 9ed21c2bb288a11e4ca2436f4757abda
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dbg_2.4.10-1ubuntu1.2_amd64.deb
      Size/MD5: 10299800 a385ad242f16a96a1ba27b8945255856
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dev_2.4.10-1ubuntu1.2_amd64.deb
      Size/MD5:  2841762 39311a1c6efc513741b6d38cd1b38f68

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gtk+2.0/gtk2.0-examples_2.4.10-1ubuntu1.2_i386.deb
      Size/MD5:   258802 74c64c0bc8320c3452d63f9c4dfe4579
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-7ubuntu1.2_i386.deb
      Size/MD5:   147244 70d3c463e5158902c8218806cf9bea26
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-7ubuntu1.2_i386.deb
      Size/MD5:     7646 46d4bf959232f67c91d79fbd65c8dcf6
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-7ubuntu1.2_i386.deb
      Size/MD5:     7196 d3ce271d26cc27a9e5c0a6210fcf7572
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-7ubuntu1.2_i386.deb
      Size/MD5:   167628 de9143f819e8bb0dcffcee6a4db792d8
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0_2.4.10-1ubuntu1.2_i386.deb
      Size/MD5:  2000838 4847eb2dd4a72f5bc34854760923d050
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-bin_2.4.10-1ubuntu1.2_i386.deb
      Size/MD5:    13274 b714b3281ff91c464a656a4925d0a00d
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dbg_2.4.10-1ubuntu1.2_i386.deb
      Size/MD5: 10067838 0c8607d981f29d1299b64595bcb99b67
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dev_2.4.10-1ubuntu1.2_i386.deb
      Size/MD5:  2484502 6f66278c77a34c1d3a15e1c83c41e1a2

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gtk+2.0/gtk2.0-examples_2.4.10-1ubuntu1.2_powerpc.deb
      Size/MD5:   260572 e24add495a04c1c1b25c272930cbb84c
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-7ubuntu1.2_powerpc.deb
      Size/MD5:   163110 173f3e9c62f04eaf2172f9a2ce83a4b1
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-7ubuntu1.2_powerpc.deb
      Size/MD5:     9168 2e23ba689c73ffed8e0152b21fc583ad
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-7ubuntu1.2_powerpc.deb
      Size/MD5:     9498 37a0696d1b507bb92915483283e59157
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-7ubuntu1.2_powerpc.deb
      Size/MD5:   192398 870f2b56e70c4693d56fb8edfb0aff3c
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0_2.4.10-1ubuntu1.2_powerpc.deb
      Size/MD5:  2118712 d8a59f2012eb87e363aa79e3170a6b6b
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-bin_2.4.10-1ubuntu1.2_powerpc.deb
      Size/MD5:    16074 c7169e71f2312165522ba44f83cdeb48
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dbg_2.4.10-1ubuntu1.2_powerpc.deb
      Size/MD5: 10329116 bac97fb5baf484e99a9a50a1ed786547
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dev_2.4.10-1ubuntu1.2_powerpc.deb
      Size/MD5:  3084958 9425daad3786af42ab3e86fcc6cf8b33

Updated packages for Ubuntu 5.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0-7ubuntu2.1.diff.gz
      Size/MD5:   376111 c492f91b00c2916bf8bb2fba1361a4ff
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0-7ubuntu2.1.dsc
      Size/MD5:      723 171466244a96b3dade56b6e0c8efa1ca
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0.orig.tar.gz
      Size/MD5:   519266 4db0503b5a62533db68b03908b981751
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk+2.0_2.6.4-0ubuntu3.1.diff.gz
      Size/MD5:    50149 53e5fdc9aaf4451b87db8e29df81040f
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk+2.0_2.6.4-0ubuntu3.1.dsc
      Size/MD5:     1985 a4df4df6c18f334aa4ae129eb8e8afbb
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk+2.0_2.6.4.orig.tar.gz
      Size/MD5: 16354198 a3ab72c9c80384fb707b992eb8b43c13

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-common_2.6.4-0ubuntu3.1_all.deb
      Size/MD5:  2983638 8ab05d1bc68d9c1d22ee741381742639
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-doc_2.6.4-0ubuntu3.1_all.deb
      Size/MD5:  2317310 ee17ef17235d1d6a4ef0d54e031e123a

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-0ubuntu3.1_amd64.deb
      Size/MD5:    54608 dc1bb20ecdd52f4fb0c0497b1567a131
    http://security.ubuntu.com/ubuntu/pool/universe/g/gtk+2.0/gtk2.0-examples_2.6.4-0ubuntu3.1_amd64.deb
      Size/MD5:   262538 06ad53a8d18d71e75361d72d2a4ba840
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-7ubuntu2.1_amd64.deb
      Size/MD5:   155372 363d72111cf8691af67f3dfb4f53994f
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-7ubuntu2.1_amd64.deb
      Size/MD5:     8522 b7bb042616403a28aeb3786ae4918797
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-7ubuntu2.1_amd64.deb
      Size/MD5:     7944 f64f19f57edd9e054a09a1e742f72b39
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-7ubuntu2.1_amd64.deb
      Size/MD5:   183480 16e6686cab0a7476e60efc5593647a26
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-0ubuntu3.1_amd64.deb
      Size/MD5: 17676230 a5873b870d4789023b3c17d76d661f6a
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0_2.6.4-0ubuntu3.1_amd64.deb
      Size/MD5:  2197970 1c7e872997f54018cf6102584e70e328
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-0ubuntu3.1_amd64.deb
      Size/MD5:    19696 53805eba8075e324953080bd2131847f
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-0ubuntu3.1_amd64.deb
      Size/MD5:  7618474 83fa7192d257564740c694f3d0b1b649

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-0ubuntu3.1_i386.deb
      Size/MD5:    49376 1d5c883b7ddaa60bfaf9f9953450820c
    http://security.ubuntu.com/ubuntu/pool/universe/g/gtk+2.0/gtk2.0-examples_2.6.4-0ubuntu3.1_i386.deb
      Size/MD5:   255970 97c1e374b68e1b54fe3d931bda5e9a69
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-7ubuntu2.1_i386.deb
      Size/MD5:   147242 681b96f88d7bb61ce8012f57e2de71bf
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-7ubuntu2.1_i386.deb
      Size/MD5:     7644 ab947e05d78b0aeb5beb9705fd3bfc6c
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-7ubuntu2.1_i386.deb
      Size/MD5:     7192 2702e72f80b01417685cd09d03a4253d
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-7ubuntu2.1_i386.deb
      Size/MD5:   167646 1dfb1075ad22d145c945fc5839710d79
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-0ubuntu3.1_i386.deb
      Size/MD5: 17551084 07c30b56ec71a96e7c88cea0c8a50f6b
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0_2.6.4-0ubuntu3.1_i386.deb
      Size/MD5:  2043574 d367d1ef37e870cdb33f2d69d35f4398
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-0ubuntu3.1_i386.deb
      Size/MD5:    18054 9f9ecf765d714ba1e64ab7edfe5c6161
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-0ubuntu3.1_i386.deb
      Size/MD5:  7137350 123f813938ce0a1725a167a41bcd2ddf

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk2-engines-pixbuf_2.6.4-0ubuntu3.1_powerpc.deb
      Size/MD5:    56252 c1b6e25af8dbf755c8f4a601320dee44
    http://security.ubuntu.com/ubuntu/pool/universe/g/gtk+2.0/gtk2.0-examples_2.6.4-0ubuntu3.1_powerpc.deb
      Size/MD5:   259464 00f3744cd69651d372e5b31656a10ce7
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-7ubuntu2.1_powerpc.deb
      Size/MD5:   163124 0fc9827cd18461e700f8b4ec497075ae
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-7ubuntu2.1_powerpc.deb
      Size/MD5:     9186 55b0581a3831617bc758cf188cd7fa4c
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-7ubuntu2.1_powerpc.deb
      Size/MD5:     9524 027786275a38c446a14bcab84c1a1fc3
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-7ubuntu2.1_powerpc.deb
      Size/MD5:   192608 6a844ec75ed699a046db71dcae6f72af
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0-dbg_2.6.4-0ubuntu3.1_powerpc.deb
      Size/MD5: 28634736 4d128cb79409de36d3493eb1dcc02387
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0_2.6.4-0ubuntu3.1_powerpc.deb
      Size/MD5:  2185946 9047f48927c90012dedb1cdc5c9171ae
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-bin_2.6.4-0ubuntu3.1_powerpc.deb
      Size/MD5:    22242 ebea993df111769c27a03bec910c566f
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dev_2.6.4-0ubuntu3.1_powerpc.deb
      Size/MD5:  8261626 d729db63b9dc745ad81bac701ff4aa8b

Updated packages for Ubuntu 5.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0-8ubuntu0.1.diff.gz
      Size/MD5:   375944 00715885ca7bc8de1d19c146b899a4b7
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0-8ubuntu0.1.dsc
      Size/MD5:      723 2caafab67407c8e22021f0129a515f96
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/gdk-pixbuf_0.22.0.orig.tar.gz
      Size/MD5:   519266 4db0503b5a62533db68b03908b981751
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk+2.0_2.8.6-0ubuntu2.1.diff.gz
      Size/MD5:    52717 02d76a955747bb6d6363c842094fbcf6
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk+2.0_2.8.6-0ubuntu2.1.dsc
      Size/MD5:     2109 d5cd5a823b465fa6b2691cd9bb92cb63
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk+2.0_2.8.6.orig.tar.gz
      Size/MD5: 17454378 9787feb9a4ece62aec9cf1d7e676ba6d

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-common_2.8.6-0ubuntu2.1_all.deb
      Size/MD5:  3413588 f7299b417104b77813160e70f0240db0
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-doc_2.8.6-0ubuntu2.1_all.deb
      Size/MD5:  2378168 98b9ce5688e70cfff876505dfea8bebe

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk2-engines-pixbuf_2.8.6-0ubuntu2.1_amd64.deb
      Size/MD5:    52452 7a14c9e5c6a273b21b893f0f5c82038a
    http://security.ubuntu.com/ubuntu/pool/universe/g/gtk+2.0/gtk2.0-examples_2.8.6-0ubuntu2.1_amd64.deb
      Size/MD5:   270748 9d94e2017bb2d2a755bc89c55606f58a
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8ubuntu0.1_amd64.deb
      Size/MD5:   157354 ec6af1a89ce275876ac8b9f1aa5fae83
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8ubuntu0.1_amd64.deb
      Size/MD5:     8396 5151f8f8eb5bde4f2d8f17136fa4864f
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8ubuntu0.1_amd64.deb
      Size/MD5:     7620 d9db000d4335d88ddf3b3082f9e87ae1
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8ubuntu0.1_amd64.deb
      Size/MD5:   183950 9b5a0c4d53b53f09d4e889f2e5c18e57
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0-dbg_2.8.6-0ubuntu2.1_amd64.deb
      Size/MD5:  4236698 41432dada3e85b7e46b76399b455360a
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0_2.8.6-0ubuntu2.1_amd64.deb
      Size/MD5:  2272976 66b4c1d2c6c0b0e18918b23525691e39
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-bin_2.8.6-0ubuntu2.1_amd64.deb
      Size/MD5:    23060 192f2fe3f61f6ae1a17879342491d9af
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dev_2.8.6-0ubuntu2.1_amd64.deb
      Size/MD5:  2609212 e8c97c27e3ef6e1d7bcad87b27e70ee9

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk2-engines-pixbuf_2.8.6-0ubuntu2.1_i386.deb
      Size/MD5:    46732 3e7aeb058b2d5f4baedd535c6b321d14
    http://security.ubuntu.com/ubuntu/pool/universe/g/gtk+2.0/gtk2.0-examples_2.8.6-0ubuntu2.1_i386.deb
      Size/MD5:   264340 b8e7a9c45b772dfe81dd3553fa6dec40
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8ubuntu0.1_i386.deb
      Size/MD5:   147898 2bb1722dbbf96ed9dbd477e19ca172fe
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8ubuntu0.1_i386.deb
      Size/MD5:     7556 e3282c4044ea415cb3aa2532fd90a344
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8ubuntu0.1_i386.deb
      Size/MD5:     6952 4a0d002c7fbe8cadef13849879ffa2da
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8ubuntu0.1_i386.deb
      Size/MD5:   166196 d1395b65ef93c7993d8e180d08d662dd
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0-dbg_2.8.6-0ubuntu2.1_i386.deb
      Size/MD5:  3564260 3cfeb8ddc04a85495c694633e44cede0
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0_2.8.6-0ubuntu2.1_i386.deb
      Size/MD5:  2052512 1d6149e8e9de36547ad5844976d132df
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-bin_2.8.6-0ubuntu2.1_i386.deb
      Size/MD5:    21322 04bce721f7836af237cced77095c5211
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dev_2.8.6-0ubuntu2.1_i386.deb
      Size/MD5:  2215654 c20c7f62665f69b20c77013b755957f8

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/gtk2-engines-pixbuf_2.8.6-0ubuntu2.1_powerpc.deb
      Size/MD5:    53316 10c6c00f0f13ff08a98b06af52013cc2
    http://security.ubuntu.com/ubuntu/pool/universe/g/gtk+2.0/gtk2.0-examples_2.8.6-0ubuntu2.1_powerpc.deb
      Size/MD5:   269582 13d86d36370ea066a60c7b5ab91f5630
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-dev_0.22.0-8ubuntu0.1_powerpc.deb
      Size/MD5:   165518 ff275f4dcd7234fcf18623dc7756b07a
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome-dev_0.22.0-8ubuntu0.1_powerpc.deb
      Size/MD5:     9214 450d72de349ce047175414e95aad4596
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf-gnome2_0.22.0-8ubuntu0.1_powerpc.deb
      Size/MD5:     9450 f46b9f70458ea556c5ea8347cfc317d6
    http://security.ubuntu.com/ubuntu/pool/main/g/gdk-pixbuf/libgdk-pixbuf2_0.22.0-8ubuntu0.1_powerpc.deb
      Size/MD5:   190138 d8d4491b44cd5e63b531c4c860e201c6
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0-dbg_2.8.6-0ubuntu2.1_powerpc.deb
      Size/MD5:  4190192 d62f5f56465c2a9a3cc21125c6cf6f08
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-0_2.8.6-0ubuntu2.1_powerpc.deb
      Size/MD5:  2250052 1ee48c6a95c0b7b59e1d810f8c926a86
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-bin_2.8.6-0ubuntu2.1_powerpc.deb
      Size/MD5:    25728 887cd5903d20072297ff5480895ce40d
    http://security.ubuntu.com/ubuntu/pool/main/g/gtk+2.0/libgtk2.0-dev_2.8.6-0ubuntu2.1_powerpc.deb
      Size/MD5:  2709362 06c909526b10fa95b56fe1bdb4fe4257
    

- 漏洞信息 (F41658)

iDEFENSE Security Advisory 2005-11-15.1 (PacketStormID:F41658)
2005-11-20 00:00:00
iDefense Labs,infamous41md  idefense.com
advisory,remote,overflow,arbitrary,code execution
CVE-2005-3186
[点击下载]

iDEFENSE Security Advisory 11.15.05 - Remote exploitation of heap overflow vulnerability in various vendors' implementations of the GTK+ gdk-pixbuf XPM image rendering library could allow for arbitrary code execution. iDEFENSE has confirmed the existence of this vulnerability in gtk+ 2.4.0 compiled from source. It is suspected that previous versions are also affected by this vulnerability.

Multiple Vendor GTK+ gdk-pixbuf XPM Loader Heap Overflow Vulnerability

iDEFENSE Security Advisory 11.15.05
www.idefense.com/application/poi/display?id=339&type=vulnerabilities
November 15, 2005

I. BACKGROUND

GTK+ is a multi-platform toolkit for creating graphical user interfaces.
Offering a complete set of widgets, GTK+ is suitable for projects
ranging from small one-off projects to complete application suites.

II. DESCRIPTION

Remote exploitation of heap overflow vulnerability in various vendors'
implementations of the GTK+ gdk-pixbuf XPM image rendering library could
allow for arbitrary code execution.

The vulnerability specifically exists due to an integer overflow while
processing XPM files. The following code snippet illustrates the
vulnerability:

if (n_col <= 0 || n_col >= G_MAXINT / (cpp + 1)) {
                g_set_error (error,
                             GDK_PIXBUF_ERROR,
                             GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
                             _("XPM file has invalid number of colors"));
        return NULL;
    }
[...]
colors = (XPMColor *) g_try_malloc ((sizeof (XPMColor) * n_col));
[...]


The validity check of n_col is enough to prevent an integer overflow in
the first g_try_malloc, however there is not a proper check for the
second g_try_malloc, which allows an undersized heap buffer to be
allocated, then overflowed while using n_col as an upper bounds in a
copying loop. This can be used to execute arbitrary code via traditional
heap overflow 4 byte write methods or by overwriting adjacent areas of
the heap with important values such as function pointers.

III. ANALYSIS

Exploitation could allow for arbitrary code execution in the context of
the user running the affected application. As this library is used in a
variety of applications, this vulnerability could be exploited either
remotely, via a networked application or locally.

IV. DETECTION

iDEFENSE has confirmed the existence of this vulnerability in gtk+ 2.4.0
compiled from source. It is suspected that previous versions are also
affected by this vulnerability. The following vendors include
susceptible GTK+ and GdkPixBuf packages within their respective
operating system distributions:

    The Debian Project:
      Debian GNU/Linux 3.0 and 3.1 (all architectures)
    Mandriva (formerly Mandrakesoft):
      Mandriva Linux (formerly Mandrakelinux) 10.0 and 10.1,
      Corporate Server 3.0
    Novell Inc.:
      SuSE Linux 8.2, 9.0, 9.1 and 9.2
    Red Hat Inc.:
      Red Hat Enterprise Linux 2.1, 3, 4,
      Fedora Core 3, 4

V. WORKAROUND

Users should not open untrusted media files.

VI. VENDOR RESPONSE

Red Hat Inc.:

"This issue affects the gtk2 packages as shipped with Red Hat Enterprise
Linux 3 and 4, and the gdk-pixbuf packages as shipped with Red Hat
Enterprise Linux 2.1, 3, and 4.  Updates to these packages are available
at the URL below or by using the Red Hat Network up2date tool.
http://rhn.redhat.com/errata/CVE-2005-3186.html

This issue affects the gtk2 and gdk-pixbuf packages as shipped with
Fedora Core 3 and 4."

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-3186 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

10/12/2005  Initial vendor notification
10/14/2005  Initial vendor response
11/15/2005  Coordinated public disclosure

IX. CREDIT

infamous41md is credited with the discovery of this vulnerability.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright     

- 漏洞信息

20840
GTK+ GdkPixbuf XPM Image Processing Overflow
Remote / Network Access Input Manipulation
Loss of Integrity Patch / RCS
Exploit Private Vendor Verified, Coordinated Disclosure

- 漏洞描述

- 时间线

2005-11-15 Unknow
Unknow 2005-11-15

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Red Hat has released a patch to address this vulnerability.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

GDK-Pixbuf/GTK XPM Images Buffer Overflow Vulnerability
Boundary Condition Error 15435
Yes No
2005-11-15 12:00:00 2006-12-22 12:03:00
infamous41md is credited with the discovery of this vulnerability.

- 受影响的程序版本

Ubuntu Ubuntu Linux 5.10 powerpc
Ubuntu Ubuntu Linux 5.10 i386
Ubuntu Ubuntu Linux 5.10 amd64
Ubuntu Ubuntu Linux 5.0 4 powerpc
Ubuntu Ubuntu Linux 5.0 4 i386
Ubuntu Ubuntu Linux 5.0 4 amd64
Ubuntu Ubuntu Linux 4.1 ppc
Ubuntu Ubuntu Linux 4.1 ia64
Ubuntu Ubuntu Linux 4.1 ia32
Trustix Secure Linux 3.0
Trustix Secure Linux 2.2
TouchTunes Rhapsody
TouchTunes Maestro
SuSE SUSE Linux Enterprise Server 8
+ Linux kernel 2.4.21
+ Linux kernel 2.4.19
SGI ProPack 3.0 SP6
SCO Open Server 6.0
SCO Open Server 5.0.7
SCO Open Server 5.0.6
S.u.S.E. UnitedLinux 1.0
S.u.S.E. Linux Professional 10.0 OSS
S.u.S.E. Linux Professional 10.0
S.u.S.E. Linux Professional 9.3 x86_64
S.u.S.E. Linux Professional 9.3
S.u.S.E. Linux Professional 9.2 x86_64
S.u.S.E. Linux Professional 9.2
S.u.S.E. Linux Professional 9.1 x86_64
S.u.S.E. Linux Professional 9.1
S.u.S.E. Linux Professional 9.0 x86_64
S.u.S.E. Linux Professional 9.0
S.u.S.E. Linux Personal 10.0 OSS
S.u.S.E. Linux Personal 9.3 x86_64
S.u.S.E. Linux Personal 9.3
S.u.S.E. Linux Personal 9.2 x86_64
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1 x86_64
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 9.0 x86_64
S.u.S.E. Linux Personal 9.0
S.u.S.E. Linux Personal 8.2
S.u.S.E. Linux Enterprise Server for S/390 9.0
S.u.S.E. Linux Enterprise Server 9
S.u.S.E. Linux Desktop 1.0
RedHat Linux 9.0 i386
RedHat Linux 7.3 i386
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux WS 2.1 IA64
RedHat Enterprise Linux WS 2.1
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux ES 2.1 IA64
RedHat Enterprise Linux ES 2.1
RedHat Desktop 4.0
RedHat Desktop 3.0
RedHat Advanced Workstation for the Itanium Processor 2.1 IA64
RedHat Advanced Workstation for the Itanium Processor 2.1
Red Hat Fedora Core4
Red Hat Fedora Core3
Red Hat Fedora Core2
Red Hat Fedora Core1
Red Hat Enterprise Linux AS 4
Red Hat Enterprise Linux AS 3
Red Hat Enterprise Linux AS 2.1 IA64
Red Hat Enterprise Linux AS 2.1
Mandriva Linux Mandrake 2006.0 x86_64
Mandriva Linux Mandrake 2006.0
Mandriva Linux Mandrake 10.2 x86_64
Mandriva Linux Mandrake 10.2
Mandriva Linux Mandrake 10.1
Mandriva Linux Mandrake 10.0
MandrakeSoft Corporate Server 3.0 x86_64
MandrakeSoft Corporate Server 3.0
MandrakeSoft Corporate Server 2.1 x86_64
MandrakeSoft Corporate Server 2.1
GTK GTK+ 2.8.6
GTK GTK+ 2.8.3
GTK GTK+ 2.6.7
GTK GTK+ 2.6.4
GTK GTK+ 2.4.13
GTK GTK+ 2.4.10
GTK GTK+ 2.4.9
GTK GTK+ 2.4.1
GTK GTK+ 2.2.4
+ MandrakeSoft Corporate Server 3.0 x86_64
+ MandrakeSoft Corporate Server 3.0
+ Mandriva Linux Mandrake 10.1 x86_64
+ Mandriva Linux Mandrake 10.1
+ Mandriva Linux Mandrake 10.0 AMD64
+ Mandriva Linux Mandrake 10.0
GTK GTK+ 2.2.3
GTK GTK+ 2.0.2
GNOME GdkPixbuf 0.22
+ MandrakeSoft Corporate Server 3.0 x86_64
+ MandrakeSoft Corporate Server 3.0
+ Mandriva Linux Mandrake 10.1 x86_64
+ Mandriva Linux Mandrake 10.1
+ Mandriva Linux Mandrake 10.0 AMD64
+ Mandriva Linux Mandrake 10.0
GNOME GdkPixbuf 0.14
+ Debian Linux 3.0 sparc
+ Debian Linux 3.0 s/390
+ Debian Linux 3.0 ppc
+ Debian Linux 3.0 mipsel
+ Debian Linux 3.0 mips
+ Debian Linux 3.0 m68k
+ Debian Linux 3.0 ia-64
+ Debian Linux 3.0 ia-32
+ Debian Linux 3.0 hppa
+ Debian Linux 3.0 arm
+ Debian Linux 3.0 alpha
+ Debian Linux 3.0
Gentoo Linux
Debian Linux 3.1 sparc
Debian Linux 3.1 s/390
Debian Linux 3.1 ppc
Debian Linux 3.1 mipsel
Debian Linux 3.1 mips
Debian Linux 3.1 m68k
Debian Linux 3.1 ia-64
Debian Linux 3.1 ia-32
Debian Linux 3.1 hppa
Debian Linux 3.1 arm
Debian Linux 3.1 amd64
Debian Linux 3.1 alpha
Debian Linux 3.1
Debian Linux 3.0 sparc
Debian Linux 3.0 s/390
Debian Linux 3.0 ppc
Debian Linux 3.0 mipsel
Debian Linux 3.0 mips
Debian Linux 3.0 m68k
Debian Linux 3.0 ia-64
Debian Linux 3.0 ia-32
Debian Linux 3.0 hppa
Debian Linux 3.0 arm
Debian Linux 3.0 alpha
Debian Linux 3.0
Avaya Integrated Management 2.1
Avaya Integrated Management
Avaya CVLAN
Ardour Ardour 0.99

- 漏洞讨论

The gdk-pixbuf and gtk2 packages are prone to a buffer overflow. When an application that uses a vulnerable library processes a malformed XPM image file, it results in a heap-based buffer overflow. An attacker can exploit this vulnerability to execute arbitrary code in the context of the victim user.

- 漏洞利用


Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com

- 解决方案

Please see the referenced advisories for more information.


GNOME GdkPixbuf 0.14

GNOME GdkPixbuf 0.22

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站