Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2017-6314: gdk-pixbuf may freeze with large TIFF images
CVE-2017-6314 · published 9 years ago
Summary
The image library gdk-pixbuf, used in GNOME desktop environments and Linux distributions such as Fedora and Debian, can get stuck in an endless loop when it tries to open a very large TIFF file. This can make the application or system become unresponsive. Update to the latest patched version of gdk-pixbuf or avoid processing oversized TIFF files until the fix is applied.
What to do
- Update gnome gdk-pixbuf to version 2.36.12 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gnome | gdk-pixbuf |
< 2.36.12 cpe:2.3:a:gnome:gdk-pixbuf:*:*:*:*:*:*:*:* |
| fedoraproject | fedora |
30 31 cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* |
| debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file.
The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file.
References
- http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/02/21/4 Exploit Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/02/26/1 Exploit Mailing List Third Party Advisory
- http://www.securityfocus.com/bid/96779 Third Party Advisory VDB Entry
- https://bugzilla.gnome.org/show_bug.cgi?id=779020 Exploit Issue Tracking Patch Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00025.html Mailing List Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/201709-08 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published10 Mar 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-6314 · NVD
Track software like this
Free during beta