CVE-2005-3186

Description

Integer overflow in the GTK+ gdk-pixbuf XPM image rendering library in GTK+ 2.4.0 allows attackers to execute arbitrary code via an XPM file with a number of colors that causes insufficient memory to be allocated, which leads to a heap-based buffer overflow.

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 2.22% Top 20%

Vendor Advisory novell.com Vendor Advisory gentoo.org Vendor Advisory securityfocus.com Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory sco.com Vendor Advisory redhat.com Vendor Advisory idefense.com

Affected: n/a n/a

References

Link	Tags
http://www.novell.com/linux/security/advisories/2005_65_gtk2.html	vendor advisory
http://www.idefense.com/application/poi/display?id=339&type=vulnerabilities	third party advisory patch vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200511-14.xml	vendor advisory
http://www.securityfocus.com/bid/15435	vdb entry
http://secunia.com/advisories/17710	third party advisory
http://secunia.com/advisories/18509	third party advisory
http://www.securityfocus.com/archive/1/428052/100/0/threaded	vendor advisory
http://www.debian.org/security/2005/dsa-911	vendor advisory
http://secunia.com/advisories/17562	third party advisory
http://secunia.com/advisories/17615	third party advisory
http://www.redhat.com/support/errata/RHSA-2005-811.html	vendor advisory
http://secunia.com/advisories/17522	third party advisory
http://www.vupen.com/english/advisories/2005/2433	vdb entry
http://www.debian.org/security/2005/dsa-913	vendor advisory
http://secunia.com/advisories/17538	third party advisory
http://securityreason.com/securityalert/188	third party advisory
http://www.ubuntu.com/usn/usn-216-1	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:214	vendor advisory
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.8/SCOSA-2006.8.txt	vendor advisory
http://securitytracker.com/id?1015216	vdb entry
http://secunia.com/advisories/17591	third party advisory
http://secunia.com/advisories/17770	third party advisory
http://secunia.com/advisories/17594	third party advisory
http://secunia.com/advisories/17588	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9503	vdb entry signature
http://secunia.com/advisories/17592	third party advisory
http://secunia.com/advisories/17791	third party advisory
http://secunia.com/advisories/17657	third party advisory
http://www.redhat.com/support/errata/RHSA-2005-810.html	patch vendor advisory
http://support.avaya.com/elmodocs2/security/ASA-2005-229.pdf

Frequently Asked Questions

What is the severity of CVE-2005-3186?: CVE-2005-3186 has been scored as a high severity vulnerability.
How to fix CVE-2005-3186?: To fix CVE-2005-3186, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-3186 being actively exploited in the wild?: It is possible that CVE-2005-3186 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.