CVE-2016-6352
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a...
CVE-2016-6352 is a high vulnerability (CVSS 7.5) in Gnome Gdk-pixbuf, published July 27, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.85%, the 90th percentile. Fixed in gdk-pixbuf 2.35.4-1.
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- Record
CVE-2016-6352- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- Record
CVE-2016-6352- Updated
- 2026-11-02
EUVDEUVD-2016-7275 No score
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- Record
EUVD-2016-7275- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mrq8-qgpv-5qqv
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a...
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- Record
GHSA-mrq8-qgpv-5qqv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- Record
CVE-2016-6352- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVDEBIAN-CVE-2016-6352
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- Record
DEBIAN-CVE-2016-6352- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2016-6352
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.
- Record
UBUNTU-CVE-2016-6352- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0322 No score
Updated gdk-pixbuf2.0 packages fix security vulnerability
A write out-of-bounds parsing an ico file was found in gdk-pixbuf. A maliciously crafted file can cause the application to crash (CVE-2016-6352).
The gdk-pixbuf2.0 package has been updated to version 2.32.3 and patched to fix this issue, and a few other possible security issues.
- Record
MGASA-2016-0322- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10453-1 No score
gdk-pixbuf-devel-2.36.0-1.1 on GA media
These are all security issues fixed in the gdk-pixbuf-devel-2.36.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10453-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2532-1 No score
Security update for gtk2
This update for gtk2 fixes the following security issues:
- CVE-2016-6352: Some crashes were fixed, including a out of bounds write in the OneLine32() function that could be used by attackers to crash GTK/GDK programs.
- CVE-2013-7447: Avoid overflow when allocating a cairo pixbuf (bsc#966682).
- Record
SUSE-SU-2016:2532-1- Updated
- 2026-11-02
OSVUSN-3085-1 No score
gdk-pixbuf vulnerabilities
It was discovered that the GDK-PixBuf library did not properly handle specially crafted bmp images, leading to a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted bmp file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-7552)
It was discovered that the GDK-PixBuf library contained an integer overflow when handling certain images. If a user or automated system were tricked into opening a crafted image file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8875)
Franco Costantini discovered that the GDK-PixBuf library contained an out-of-bounds write error when parsing an ico file. If a user or automated system were tricked into opening a crafted ico file, a remote attacker could use this flaw to cause GDK-PixBuf to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-6352)
- Record
USN-3085-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gdk-pixbufDebian:12 |
before 2.35.4-1 | 2.35.4-1 |
gdk-pixbufDebian:13 |
before 2.35.4-1 | 2.35.4-1 |
gdk-pixbufDebian:14 |
before 2.35.4-1 | 2.35.4-1 |
gdk-pixbufDebian:8 |
before 2.31.1-2+deb8u8, plus listed versions 2.31.1-22.31.1-2+deb8u12.31.1-2+deb8u22.31.1-2+deb8u32.31.1-2+deb8u4 Show 6 moreShow less2.31.1-2+deb8u4+kbsd8u12.31.1-2+deb8u52.31.1-2+deb8u5+kbsd8u12.31.1-2+deb8u5+kbsd8u22.31.1-2+deb8u62.31.1-2+deb8u7 |
2.31.1-2+deb8u8 |
gdk-pixbuf2.0Mageia:5 |
before 2.32.3-1.mga5 | 2.32.3-1.mga5 |
gtk2SUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.18.9-0.44.1 | 2.18.9-0.44.1 |
gtk2SUSE:Linux Enterprise Server 11 SP4 |
before 2.18.9-0.44.1 | 2.18.9-0.44.1 |
gtk2SUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 2.18.9-0.44.1 | 2.18.9-0.44.1 |
gdk-pixbufUbuntu:14.04:LTS |
before 2.30.7-0ubuntu1.6, plus listed versions 2.28.1-1ubuntu22.30.0-0ubuntu22.30.1-0ubuntu22.30.2-0ubuntu12.30.2-0ubuntu2 Show 7 moreShow less2.30.3-0ubuntu12.30.4-0ubuntu12.30.5-0ubuntu12.30.6-12.30.7-0ubuntu12.30.7-0ubuntu1.12.30.7-0ubuntu1.2 |
2.30.7-0ubuntu1.6 |
gdk-pixbufUbuntu:16.04:LTS |
before 2.32.2-1ubuntu1.2, plus listed versions 2.32.1-12.32.2-12.32.2-1ubuntu1 |
2.32.2-1ubuntu1.2 |
gdk-pixbufopenSUSE:Tumbleweed |
before 2.36.0-1.1 | 2.36.0-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2016/07/26/11
git.gnome.org/browse/gdk-pixbuf/tree/NEWS?id=640134c46221689d263369872937192e4484c83b
ubuntu.com/usn/USN-3085-1
lists.opensuse.org/opensuse-updates/2016-09/msg00040.html
Show 25 moreShow less
bugzilla.gnome.org/show_bug.cgi?id=769170
lists.debian.org/debian-lts-announce/2019/12/msg00025.html
nvd.nist.gov/vuln/detail/CVE-2016-6352
github.com/advisories/GHSA-mrq8-qgpv-5qqv
security-tracker.debian.org/tracker/CVE-2016-6352
advisories.mageia.org/MGASA-2016-0322.html
bugs.mageia.org/show_bug.cgi?id=19070
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6352
suse.com/support/update/announcement/2016/suse-su-20162532-1
bugzilla.suse.com/966682
ubuntu.com/security/CVE-2016-6352
cve.org/CVERecord?id=CVE-2016-6352