Description
Double free vulnerability in gtk 2 (gtk2) before 2.2.4 allows remote attackers to cause a denial of service (crash) via a crafted BMP image.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gdk-pixbuf | 0.22.0-7.1 | — |
| Debian 14 | gtk+2.0 | 2.6.4-1 | — |
| Debian 13 | gdk-pixbuf | 0.22.0-7.1 | — |
| Debian 13 | gtk+2.0 | 2.6.4-1 | — |
| Debian 12 | gdk-pixbuf | 0.22.0-7.1 | — |
| Debian 12 | gtk+2.0 | 2.6.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | gdk-pixbuf +1 | 1:0.22.0-16.el4 | RHSA-2005:343 |
| RHEL 4 | gtk2 +1 | 2.4.13-14 | RHSA-2005:344 |
| RHEL 3 | gdk-pixbuf +2 | 1:0.22.0-12.el3 | RHSA-2005:343 |
| RHEL 3 | gtk2 +1 | 2.2.4-15 | RHSA-2005:344 |
Advisories 2
- RHSA-2005:344 Red Hat Security Advisory: gtk2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:343 Red Hat Security Advisory: gdk-pixbuf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 12950 vdb-entry
- CLSA-2005:958 vendor-advisory
- RHSA-2005:343 vendor-advisory
- MDKSA-2005:214 vendor-advisory
- FLSA-2005:155510 vendor-advisory
- RHSA-2005:344 vendor-advisory
- oval:org.mitre.oval:def:9710 vdb-entry signature
- 17657 third-party-advisory