Description
Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gtk+2.0 | 2.4.9-2 | — |
| Debian 13 | gtk+2.0 | 2.4.9-2 | — |
| Debian 12 | gtk+2.0 | 2.4.9-2 | — |
| Debian 3.0 | gtk+2.0 | 2.0.2-5woody2 | DSA-549-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | gdk-pixbuf +2 | 1:0.22.0-11.3.3 | RHSA-2004:447 |
| RHEL 3 | gtk2 +1 | 2.2.4-8.1 | RHSA-2004:466 |
Advisories 3
- RHSA-2004:466 Red Hat Security Advisory: gtk2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:447 Red Hat Security Advisory: gdk-pixbuf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-549-1 gtk+2.0 - multiple holes Debian Security (DSA / DLA) · Mar 9, 2026
References
- 101776 vendor-advisory
- FLSA:2005 vendor-advisory
- http://scary.beasts.org/security/CESA-2004-005.txt
- oval:org.mitre.oval:def:9348 vdb-entry signature
- oval:org.mitre.oval:def:1786 vdb-entry signature
- RHSA-2004:466 vendor-advisory
- 20040915 CESA-2004-005: gtk+ XPM decoder mailing-list
- gtk-xpm-xpmextractcolor-bo(17385) vdb-entry
- VU#369358 third-party-advisory
- MDKSA-2005:214 vendor-advisory
- FLSA-2005:155510 vendor-advisory
- MDKSA-2004:095 vendor-advisory
- MDKSA-2004:096 vendor-advisory
- 11195 vdb-entry
- RHSA-2004:447 vendor-advisory
- CLA-2004:875 vendor-advisory
- 17657 third-party-advisory