CVE-2017-1000422

moderate-risk

Published 2018-01-02

Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution

Do I need to act?

0.96% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (7)

Gdk-Pixbuf

Debian Linux

Ubuntu Linux

Affected Vendors

Debian Gnome Canonical

References (10)

Issue Tracking https://bugzilla.gnome.org/show_bug.cgi?id=785973

Mailing List https://lists.debian.org/debian-lts-announce/2018/01/msg00007.html

Third Party Advisory https://security.gentoo.org/glsa/201804-14

Third Party Advisory https://usn.ubuntu.com/3532-1/

Third Party Advisory https://www.debian.org/security/2018/dsa-4088

Issue Tracking https://bugzilla.gnome.org/show_bug.cgi?id=785973

Mailing List https://lists.debian.org/debian-lts-announce/2018/01/msg00007.html

Third Party Advisory https://security.gentoo.org/glsa/201804-14

Third Party Advisory https://usn.ubuntu.com/3532-1/

Third Party Advisory https://www.debian.org/security/2018/dsa-4088

/ 100

moderate-risk

Severity 30/34 · Critical

Exploitability 3/34 · Minimal

Exposure 14/34 · Moderate