Security update for gtk2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1787-1 Final 1 1 2015-10-07T10:26:33Z current 2015-10-07T10:26:33Z 2015-10-07T10:26:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gtk2 gtk2 was updated to fix two security issues. These security issues were fixed: - CVE-2015-4491: Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, allowed remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that were mishandled during scaling (bsc#942801). - CVE-2015-7674: Fix overflow when scaling GIF files (bsc#948791). This non-security issue was fixed: - Add the script which generates gdk-pixbuf64.loaders to the spec file (bsc#922741). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-gtk2-12146,sdksp4-gtk2-12146,sledsp3-gtk2-12146,sledsp4-gtk2-12146,slessp3-gtk2-12146,slessp4-gtk2-12146 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151787-1/ Link for SUSE-SU-2015:1787-1 https://lists.suse.com/pipermail/sle-security-updates/2015-October/001638.html E-Mail link for SUSE-SU-2015:1787-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/922741 SUSE Bug 922741 https://bugzilla.suse.com/942801 SUSE Bug 942801 https://bugzilla.suse.com/948791 SUSE Bug 948791 https://www.suse.com/security/cve/CVE-2015-4491/ SUSE CVE CVE-2015-4491 page https://www.suse.com/security/cve/CVE-2015-7674/ SUSE CVE CVE-2015-7674 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP4 gtk2-devel-2.18.9-0.35.1 gtk2-devel-32bit-2.18.9-0.35.1 gtk2-2.18.9-0.35.1 gtk2-32bit-2.18.9-0.35.1 gtk2-lang-2.18.9-0.35.1 gtk2-doc-2.18.9-0.35.1 gtk2-x86-2.18.9-0.35.1 gtk2-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 gtk2-32bit-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 gtk2-lang-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 gtk2-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Desktop 11 SP4 gtk2-32bit-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Desktop 11 SP4 gtk2-lang-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Desktop 11 SP4 gtk2-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3 gtk2-32bit-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3 gtk2-doc-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3 gtk2-lang-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3 gtk2-x86-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3 gtk2-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA gtk2-32bit-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA gtk2-doc-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA gtk2-lang-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA gtk2-x86-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA gtk2-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP4 gtk2-32bit-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP4 gtk2-doc-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP4 gtk2-lang-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP4 gtk2-x86-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server 11 SP4 gtk2-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 gtk2-32bit-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 gtk2-doc-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 gtk2-lang-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 gtk2-x86-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 gtk2-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 gtk2-32bit-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 gtk2-doc-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 gtk2-lang-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 gtk2-x86-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 gtk2-devel-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 gtk2-devel-32bit-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 gtk2-devel-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 gtk2-devel-32bit-2.18.9-0.35.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling. CVE-2015-4491 SUSE Linux Enterprise Desktop 11 SP3:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP3:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP3:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP4:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP4:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP4:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Software Development Kit 11 SP3:gtk2-devel-2.18.9-0.35.1 SUSE Linux Enterprise Software Development Kit 11 SP3:gtk2-devel-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gtk2-devel-2.18.9-0.35.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gtk2-devel-32bit-2.18.9-0.35.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151787-1/ https://www.suse.com/security/cve/CVE-2015-4491.html CVE-2015-4491 https://bugzilla.suse.com/940806 SUSE Bug 940806 https://bugzilla.suse.com/942801 SUSE Bug 942801 https://bugzilla.suse.com/948790 SUSE Bug 948790 Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow. CVE-2015-7674 SUSE Linux Enterprise Desktop 11 SP3:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP3:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP3:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP4:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP4:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Desktop 11 SP4:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP3:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server 11 SP4:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-doc-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-lang-2.18.9-0.35.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gtk2-x86-2.18.9-0.35.1 SUSE Linux Enterprise Software Development Kit 11 SP3:gtk2-devel-2.18.9-0.35.1 SUSE Linux Enterprise Software Development Kit 11 SP3:gtk2-devel-32bit-2.18.9-0.35.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gtk2-devel-2.18.9-0.35.1 SUSE Linux Enterprise Software Development Kit 11 SP4:gtk2-devel-32bit-2.18.9-0.35.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151787-1/ https://www.suse.com/security/cve/CVE-2015-7674.html CVE-2015-7674 https://bugzilla.suse.com/948791 SUSE Bug 948791