Bug#856445: gdk-pixbuf: CVE-2017-6313: Integer underflow in io-icns.c

[Salvatore Bonaccorso]

Control: severity -1 serious
Control: fixed -1 2.36.5-2+deb9u2

Raising severity to RC to avoid regression stretch->buster. It has
been fixed in a DSA.

Regards,
Salvatore

Bug#856445: gdk-pixbuf: CVE-2017-6313: Integer underflow in io-icns.c

[Salvatore Bonaccorso]

Control: tags -1 + fixed-upstream patch

Fixed upstream via:

https://git.gnome.org/browse/gdk-pixbuf/commit/?id=210b16399a492d05efb209615a143920b24251f4

Regards,
Salvatore

Bug#856445: gdk-pixbuf: CVE-2017-6313: Integer underflow in io-icns.c

[Salvatore Bonaccorso]

Source: gdk-pixbuf
Version: 2.31.1-2
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for gdk-pixbuf. There is no
patch upstream yet, and from a quick skim over io-icns.c the soure is
there.

CVE-2017-6313[0]:
An dangerous integer underflow in io-icns.c

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-6313
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6313

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore