CVE-2017-2862

HIGH7.8EPSS 4.6%

gdk-pixbuf - security update

Published: 9/5/2017Modified: 11/19/2025

Also known as:DSA-3978-1ALPINE-CVE-2017-2862DEBIAN-CVE-2017-2862

Description

An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.

Affected packages (4)

Alpine/gdk-pixbuffrom 0, < 2.32.0-r2
Debian/gdk-pixbuffrom 0, < 2.36.10-1
Debian/gdk-pixbuffrom 0, < 2.26.1-1+deb7u6
Debian/gdk-pixbuffrom 0, < 2.31.1-2+deb8u6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2017-2862
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2017-2862