CVE-2017-6314

NameCVE-2017-6314
DescriptionThe make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2043-1
NVD severitymedium
Debian Bugs856448

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gdk-pixbuf (PTS)stretch (security), stretch2.36.5-2+deb9u2fixed
buster2.38.1+dfsg-1fixed
bullseye2.42.2+dfsg-1fixed
bookworm, sid2.42.6+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gdk-pixbufsourcejessie2.31.1-2+deb8u8DLA-2043-1
gdk-pixbufsourcestretch2.36.5-2+deb9u2
gdk-pixbufsource(unstable)2.36.11-2low856448

Notes

[wheezy] - gdk-pixbuf <no-dsa> (Minor issue, can be fixed in next update)
https://bugzilla.gnome.org/show_bug.cgi?id=779020
http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.html
Fixed by: https://git.gnome.org/browse/gdk-pixbuf/commit/?id=1e513abdb55529f888233d3c96b27352d83aad5f

Search for package or bug name: Reporting problems