CVE-2005-2976

Description

Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbitrary code via an XPM file with large height, width, and colour values, a different vulnerability than CVE-2005-3186.

How to fix CVE-2005-2976

To remediate CVE-2005-2976, upgrade the affected package to a fixed version below.

• Debian/gdk-pixbuf—upgrade to 0.22.0-11 or later
• Debian/gtk+2.0—upgrade to 2.6.10-2 or later

Is CVE-2005-2976 being exploited?

Low — EPSS is 1.7%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.22.0-11
• from 0, < 2.6.10-2

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2005-2976