Risk | High |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2017-2862 |
CWE-ID | CWE-122 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software |
gdk-pixbuf (Alpine package) Operating systems & Components / Operating system package or component |
Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU8062
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2017-2862
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the targeted system.
The weakness exists in the gdk_pixbuf__jpeg_image_load_increment function due to heap-based buffer overflow. A remote attacker can trick the victim to click a malicious link or open a specially crafted JPEG file, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability may result in system compromise.
Install update from vendor's website.
Vulnerable software versionsgdk-pixbuf (Alpine package): 2.32.2-r1
CPE2.3 External linkshttps://git.alpinelinux.org/aports/commit/?id=d49b5d11fbcaa348507fd036c91cfd519e4ff228
https://git.alpinelinux.org/aports/commit/?id=f3e098d50b3ee42a9273cdde2c0b34881fd6eeb8
https://git.alpinelinux.org/aports/commit/?id=fd675253d41cdf64556335754ccf378fae492529
https://git.alpinelinux.org/aports/commit/?id=ba4d4f6e7bbd772981efff7c04da58b701a5b538
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.