Description
Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gdk-pixbuf | 0.22.0-7 | — |
| Debian 14 | gtk+2.0 | 2.4.9-2 | — |
| Debian 13 | gdk-pixbuf | 0.22.0-7 | — |
| Debian 13 | gtk+2.0 | 2.4.9-2 | — |
| Debian 12 | gdk-pixbuf | 0.22.0-7 | — |
| Debian 12 | gtk+2.0 | 2.4.9-2 | — |
| Debian 3.0 | gdk-pixbuf | 0.17.0-2woody2 | DSA-546-1 |
| Debian 3.0 | gtk+2.0 | 2.0.2-5woody2 | DSA-549-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | gdk-pixbuf +2 | 1:0.22.0-11.3.3 | RHSA-2004:447 |
| RHEL 3 | gtk2 +1 | 2.2.4-8.1 | RHSA-2004:466 |
Advisories 4
- RHSA-2004:466 Red Hat Security Advisory: gtk2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:447 Red Hat Security Advisory: gdk-pixbuf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-549-1 gtk+2.0 - multiple holes Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-546-1 gdk-pixbuf - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 101776 vendor-advisory
- oval:org.mitre.oval:def:11539 vdb-entry signature
- FLSA:2005 vendor-advisory
- DSA-546 vendor-advisory
- http://scary.beasts.org/security/CESA-2004-005.txt
- RHSA-2004:466 vendor-advisory
- 20040915 CESA-2004-005: gtk+ XPM decoder mailing-list
- MDKSA-2005:214 vendor-advisory
- FLSA-2005:155510 vendor-advisory
- MDKSA-2004:095 vendor-advisory
- 11195 vdb-entry
- oval:org.mitre.oval:def:1617 vdb-entry signature
- RHSA-2004:447 vendor-advisory
- CLA-2004:875 vendor-advisory
- 17657 third-party-advisory
- gtk-xpm-pixbufcreatefromxpm-bo(17386) vdb-entry
- VU#729894 third-party-advisory