CVE-2004-0782

Description

Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 30.04% Top 5%

Vendor Advisory sun.com Vendor Advisory fedora.us Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory securityfocus.com Vendor Advisory mandrakesecure.net Vendor Advisory redhat.com Vendor Advisory com.br

Affected: n/a n/a

References

Link	Tags
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101776-1	third party advisory vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11539	vdb entry signature broken link
https://bugzilla.fedora.us/show_bug.cgi?id=2005	issue tracking vendor advisory
http://www.debian.org/security/2004/dsa-546	third party advisory vendor advisory
http://scary.beasts.org/security/CESA-2004-005.txt	third party advisory
http://www.redhat.com/support/errata/RHSA-2004-466.html	patch vendor advisory
http://marc.info/?l=bugtraq&m=109528994916275&w=2	third party advisory mailing list
http://www.mandriva.com/security/advisories?name=MDKSA-2005:214	vendor advisory broken link
http://www.securityfocus.com/archive/1/419771/100/0/threaded	vdb entry third party advisory vendor advisory
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:095	third party advisory vendor advisory
http://www.securityfocus.com/bid/11195	vdb entry third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1617	vdb entry signature broken link
http://www.redhat.com/support/errata/RHSA-2004-447.html	patch vendor advisory
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000875	third party advisory vendor advisory
http://secunia.com/advisories/17657	third party advisory broken link
https://exchange.xforce.ibmcloud.com/vulnerabilities/17386	vdb entry third party advisory
http://www.kb.cert.org/vuls/id/729894	third party advisory us government resource

Frequently Asked Questions

What is the severity of CVE-2004-0782?: CVE-2004-0782 has been scored as a high severity vulnerability.
How to fix CVE-2004-0782?: To fix CVE-2004-0782, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2004-0782 being actively exploited in the wild?: It is possible that CVE-2004-0782 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~30% probability that this vulnerability will be exploited by malicious actors in the next 30 days.