Description
Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service (segmentation fault) via an animated GIF in which the first subimage is smaller than a subsequent subimage, which triggers the overflow in the ReadImage function, a different vulnerability than CVE-2007-5137.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libtk-img | 1.3-release-8 | — |
| Debian 13 | libtk-img | 1.3-release-8 | — |
| Debian 12 | libtk-img | 1.3-release-8 | — |
| Debian 5.0 | libtk-img | 1:1.3-release-7+lenny1 | DSA-1743-1 |
| Debian 4.0 | libtk-img | 1:1.3-15etch3 | DSA-1743-1 |
| Debian 4.0 | tk8.3 | 8.3.5-6etch1 | DSA-1416-1 |
| Debian 4.0 | tk8.4 | 8.4.12-1etch1 | DSA-1415-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | tk8.4 | 8.4.9-1sarge1 | DSA-1415-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | tk +1 | 8.4.7-3.el4_6.1 | RHSA-2008:0135 |
| RHEL 3 | expect +1 | 5.38.0-92.8 | RHSA-2008:0134 |
| RHEL 3 | itcl | 3.2-92.8 | RHSA-2008:0134 |
| RHEL 3 | tclx | 8.3-92.8 | RHSA-2008:0134 |
| RHEL 3 | tix | 1:8.1.4-92.8 | RHSA-2008:0134 |
| RHEL 3 | tk +4 | 8.3.5-92.8 | RHSA-2008:0134 |
| RHEL 2 | expect | 5.38.0-75 | RHSA-2008:0134 |
| RHEL 2 | itcl | 3.2-75 | RHSA-2008:0134 |
| RHEL 2 | tcllib | 1.0-75 | RHSA-2008:0134 |
| RHEL 2 | tclx | 8.3-75 | RHSA-2008:0134 |
| RHEL 2 | tix | 8.2.0b1-75 | RHSA-2008:0134 |
| RHEL 2 | tk +2 | 8.3.3-75 | RHSA-2008:0134 |
Advisories 5
- RHSA-2008:0134 Red Hat Security Advisory: tcltk security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2008:0135 Red Hat Security Advisory: tk security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1743-1 libtk-img - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1416-1 tk8.3 - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1415-1 tk8.4 - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 30129 third-party-advisory
- RHSA-2008:0134 vendor-advisory
- ADV-2008-1744 vdb-entry
- 34297 third-party-advisory
- ADV-2008-1456 vdb-entry
- 26056 vdb-entry
- 27806 third-party-advisory
- 27801 third-party-advisory
- tktoolkit-filereadgif-dos(37189) vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2008-0009.html
- oval:org.mitre.oval:def:9480 vdb-entry signature
- https://sourceforge.net/tracker/?func=detail&atid=112997&aid=1458234&group_id=12997
- 237465 vendor-advisory
- MDKSA-2007:200 vendor-advisory
- DSA-1415 vendor-advisory
- 30535 third-party-advisory
- DSA-1743 vendor-advisory
- 20080604 VMSA-2008-0009 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues mailing-list
- 27295 third-party-advisory
- 29070 third-party-advisory
- USN-529-1 vendor-advisory
- RHSA-2008:0135 vendor-advisory
- DSA-1416 vendor-advisory
- 20071012 clarification on multiple Tk overflow issues mailing-list
- 27207 third-party-advisory