Vulnerability Name:

CVE-2004-0753 (CCN-17383)

Assigned:2004-08-20
Published:2004-08-20
Updated:2018-10-19
Summary:The BMP image processor for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted BMP file.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2004-0753

Source: CONECTIVA
Type: UNKNOWN
CLA-2004:875

Source: CCN
Type: Conectiva Linux Security Announcement CLSA-2004:875
Fixes for image loading vulnerabilities

Source: CCN
Type: RHSA-2004-447
gdk-pixbuf security update

Source: CCN
Type: RHSA-2004-466
gtk2 security update

Source: SECUNIA
Type: UNKNOWN
17657

Source: CCN
Type: CIAC Information Bulletin 0-216
"gtk2" Package Vulnerability

Source: CCN
Type: CIAC Information Bulletin 0-217
"gdk-pixbuf" Package vulnerability

Source: DEBIAN
Type: UNKNOWN
DSA-546

Source: DEBIAN
Type: DSA-546
gdk-pixbuf -- several vulnerabilities

Source: CCN
Type: GLSA-200409-28
GTK+ 2, gdk-pixbuf: Multiple image decoding vulnerabilities

Source: CCN
Type: GTK+ Web site
GTK+ - The GIMP Toolkit

Source: CCN
Type: US-CERT VU#825374
GdkPixbuf BMP parser may enter an infinite loop

Source: CERT-VN
Type: US Government Resource
VU#825374

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2004:095

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2005:214

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2004:447

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2004:466

Source: FEDORA
Type: UNKNOWN
FLSA-2005:155510

Source: BID
Type: UNKNOWN
11195

Source: CCN
Type: BID-11195
GDK-Pixbuf Multiple Vulnerabilities

Source: FEDORA
Type: UNKNOWN
FLSA:2005

Source: XF
Type: UNKNOWN
gtk-bmp-dos(17383)

Source: XF
Type: UNKNOWN
gtk-bmp-dos(17383)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10585

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnome:gdkpixbuf:0.17:*:*:*:*:*:*:*
  • OR cpe:/a:gnome:gdkpixbuf:0.18:*:*:*:*:*:*:*
  • OR cpe:/a:gnome:gdkpixbuf:0.20:*:*:*:*:*:*:*
  • OR cpe:/a:gnome:gdkpixbuf:0.22:*:*:*:*:*:*:*
  • OR cpe:/a:gtk:gtk+:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:gtk:gtk+:2.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:gtk:gtk+:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:gtk:gtk+:2.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:gtk:gtk+:2.2.4:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gtk:gtk+:2.4.4:*:*:*:*:*:*:*
  • AND
  • cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:aw:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:10:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:10585
    V
    		The BMP image processor for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted BMP file.
    2013-04-29
    oval:org.debian:def:546
    V
    		several vulnerabilities
    2004-09-16
    oval:com.redhat.rhsa:def:20040447
    P
    		RHSA-2004:447: gdk-pixbuf security update (Important)
    2004-09-15
    oval:com.redhat.rhsa:def:20040466
    P
    		RHSA-2004:466: gtk2 security update (Important)
    2004-09-15
    BACK
    gnome gdkpixbuf 0.17
    gnome gdkpixbuf 0.18
    gnome gdkpixbuf 0.20
    gnome gdkpixbuf 0.22
    gtk gtk+ 2.0.2
    gtk gtk+ 2.0.6
    gtk gtk+ 2.2.1
    gtk gtk+ 2.2.3
    gtk gtk+ 2.2.4
    gtk gtk+ 2.4.4
    debian debian linux 3.0
    gentoo linux *
    mandrakesoft mandrake linux corporate server 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    conectiva linux 9.0
    mandrakesoft mandrake linux 9.2
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    mandrakesoft mandrake linux 10.0
    redhat enterprise linux 3
    conectiva linux 10
    mandrakesoft mandrake linux corporate server 3.0
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux corporate server 3.0
    mandrakesoft mandrake linux 9.2
    mandrakesoft mandrake linux 10.0
    mandrakesoft mandrake linux corporate server 2.1