Security update for gdk-pixbuf SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2145-1 Final 1 1 2018-07-30T16:10:35Z current 2018-07-30T16:10:35Z 2018-07-30T16:10:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gdk-pixbuf This update for gdk-pixbuf fixes the following issues: Security issue fixed: - CVE-2015-4491: Fix integer multiplication overflow that allows for DoS or potentially RCE (bsc#1053417). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-1452,SUSE-SLE-SDK-12-SP3-2018-1452,SUSE-SLE-SERVER-12-SP3-2018-1452 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182145-1/ Link for SUSE-SU-2018:2145-1 https://lists.suse.com/pipermail/sle-security-updates/2018-July/004361.html E-Mail link for SUSE-SU-2018:2145-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1053417 SUSE Bug 1053417 https://www.suse.com/security/cve/CVE-2015-4491/ SUSE CVE CVE-2015-4491 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 gdk-pixbuf-lang-2.34.0-19.14.2 gdk-pixbuf-query-loaders-2.34.0-19.14.2 gdk-pixbuf-query-loaders-32bit-2.34.0-19.14.2 libgdk_pixbuf-2_0-0-2.34.0-19.14.2 libgdk_pixbuf-2_0-0-32bit-2.34.0-19.14.2 typelib-1_0-GdkPixbuf-2_0-2.34.0-19.14.2 gdk-pixbuf-devel-2.34.0-19.14.2 gdk-pixbuf-lang-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 gdk-pixbuf-query-loaders-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 gdk-pixbuf-query-loaders-32bit-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 libgdk_pixbuf-2_0-0-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 libgdk_pixbuf-2_0-0-32bit-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 typelib-1_0-GdkPixbuf-2_0-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 gdk-pixbuf-lang-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server 12 SP3 gdk-pixbuf-query-loaders-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server 12 SP3 gdk-pixbuf-query-loaders-32bit-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server 12 SP3 libgdk_pixbuf-2_0-0-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server 12 SP3 libgdk_pixbuf-2_0-0-32bit-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server 12 SP3 typelib-1_0-GdkPixbuf-2_0-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server 12 SP3 gdk-pixbuf-lang-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 gdk-pixbuf-query-loaders-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 gdk-pixbuf-query-loaders-32bit-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libgdk_pixbuf-2_0-0-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libgdk_pixbuf-2_0-0-32bit-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 typelib-1_0-GdkPixbuf-2_0-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 gdk-pixbuf-devel-2.34.0-19.14.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling. CVE-2015-4491 SUSE Linux Enterprise Desktop 12 SP3:gdk-pixbuf-lang-2.34.0-19.14.2 SUSE Linux Enterprise Desktop 12 SP3:gdk-pixbuf-query-loaders-2.34.0-19.14.2 SUSE Linux Enterprise Desktop 12 SP3:gdk-pixbuf-query-loaders-32bit-2.34.0-19.14.2 SUSE Linux Enterprise Desktop 12 SP3:libgdk_pixbuf-2_0-0-2.34.0-19.14.2 SUSE Linux Enterprise Desktop 12 SP3:libgdk_pixbuf-2_0-0-32bit-2.34.0-19.14.2 SUSE Linux Enterprise Desktop 12 SP3:typelib-1_0-GdkPixbuf-2_0-2.34.0-19.14.2 SUSE Linux Enterprise Server 12 SP3:gdk-pixbuf-lang-2.34.0-19.14.2 SUSE Linux Enterprise Server 12 SP3:gdk-pixbuf-query-loaders-2.34.0-19.14.2 SUSE Linux Enterprise Server 12 SP3:gdk-pixbuf-query-loaders-32bit-2.34.0-19.14.2 SUSE Linux Enterprise Server 12 SP3:libgdk_pixbuf-2_0-0-2.34.0-19.14.2 SUSE Linux Enterprise Server 12 SP3:libgdk_pixbuf-2_0-0-32bit-2.34.0-19.14.2 SUSE Linux Enterprise Server 12 SP3:typelib-1_0-GdkPixbuf-2_0-2.34.0-19.14.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:gdk-pixbuf-lang-2.34.0-19.14.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:gdk-pixbuf-query-loaders-2.34.0-19.14.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:gdk-pixbuf-query-loaders-32bit-2.34.0-19.14.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libgdk_pixbuf-2_0-0-2.34.0-19.14.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libgdk_pixbuf-2_0-0-32bit-2.34.0-19.14.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:typelib-1_0-GdkPixbuf-2_0-2.34.0-19.14.2 SUSE Linux Enterprise Software Development Kit 12 SP3:gdk-pixbuf-devel-2.34.0-19.14.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182145-1/ https://www.suse.com/security/cve/CVE-2015-4491.html CVE-2015-4491 https://bugzilla.suse.com/940806 SUSE Bug 940806 https://bugzilla.suse.com/942801 SUSE Bug 942801 https://bugzilla.suse.com/948790 SUSE Bug 948790