CVE-2017-1000422
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw...
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
- Record
CVE-2017-1000422- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
- Record
CVE-2017-1000422- Updated
- 2026-11-02
EUVDEUVD-2017-1559 No score
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
- Record
EUVD-2017-1559- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-245r-96m5-w336
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw...
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
- Record
GHSA-245r-96m5-w336- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
- Record
CVE-2017-1000422- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
OSVDEBIAN-CVE-2017-1000422
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
- Record
DEBIAN-CVE-2017-1000422- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2017-1000422
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution
- Record
UBUNTU-CVE-2017-1000422- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0087 No score
Updated gdk-pixbuf2.0 packages fix security vulnerability
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution. (CVE-2017-1000422)
- Record
MGASA-2018-0087- Updated
- 2026-11-02
OSVMGASA-2018-0090 No score
Updated gdk-pixbuf2.0 packages fix security vulnerability
Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution (CVE-2017-1000422).
- Record
MGASA-2018-0090- Updated
- 2026-11-02
OSVSUSE-SU-2018:1950-1 No score
Security update for gdk-pixbuf
This update for gdk-pixbuf fixes the following security issue:
- CVE-2017-1000422: Prevent several integer overflow in the gif_get_lzw function resulting in memory corruption and potential code execution (bsc#1074462).
- Record
SUSE-SU-2018:1950-1- Updated
- 2026-11-02
OSVUSN-3532-1 No score
gdk-pixbuf vulnerabilities
It was discoreved that GDK-PixBuf incorrectly handled certain gif images. An attacker could use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-1000422)
Ariel Zelivansky discovered that GDK-PixBuf incorrectly handled certain images. An attacker could use this to cause a denial of service. (CVE-2017-6312, CVE-2017-6313)
Ariel Zelivansky discovered that GDK-PixBuf incorrectly handled large TIFF files. An attacker could use this to cause a denial of service. (CVE-2017-6314)
- Record
USN-3532-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gdk-pixbufDebian:12 |
before 2.36.11-1 | 2.36.11-1 |
gdk-pixbufDebian:13 |
before 2.36.11-1 | 2.36.11-1 |
gdk-pixbufDebian:14 |
before 2.36.11-1 | 2.36.11-1 |
gdk-pixbufDebian:7 |
before 2.26.1-1+deb7u7, plus listed versions 2.26.1-12.26.1-1+deb7u12.26.1-1+deb7u22.26.1-1+deb7u32.26.1-1+deb7u42.26.1-1+deb7u52.26.1-1+deb7u6 |
2.26.1-1+deb7u7 |
gdk-pixbufDebian:8 |
before 2.31.1-2+deb8u7, plus listed versions 2.31.1-22.31.1-2+deb8u12.31.1-2+deb8u22.31.1-2+deb8u32.31.1-2+deb8u4 Show 5 moreShow less2.31.1-2+deb8u4+kbsd8u12.31.1-2+deb8u52.31.1-2+deb8u5+kbsd8u12.31.1-2+deb8u5+kbsd8u22.31.1-2+deb8u6 |
2.31.1-2+deb8u7 |
gdk-pixbufDebian:9 |
before 2.36.5-2+deb9u2, plus listed versions 2.36.5-22.36.5-2+deb9u1 |
2.36.5-2+deb9u2 |
gdk-pixbuf2.0Mageia:6 |
before 2.36.10-1.2.mga6 | 2.36.10-1.2.mga6 |
gdk-pixbuf2.0Mageia:5 |
before 2.32.3-1.2.mga5 | 2.32.3-1.2.mga5 |
gdk-pixbufSUSE:Linux Enterprise Desktop 12 SP3 |
before 2.34.0-19.11.1 | 2.34.0-19.11.1 |
gdk-pixbufSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 2.34.0-19.11.1 | 2.34.0-19.11.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gdk-pixbufSUSE:Linux Enterprise Server 12 SP3 |
before 2.34.0-19.11.1 | 2.34.0-19.11.1 |
gdk-pixbufSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.34.0-19.11.1 | 2.34.0-19.11.1 |
gdk-pixbufUbuntu:14.04:LTS |
before 2.30.7-0ubuntu1.8, plus listed versions 2.28.1-1ubuntu22.30.0-0ubuntu22.30.1-0ubuntu22.30.2-0ubuntu12.30.2-0ubuntu2 Show 9 moreShow less2.30.3-0ubuntu12.30.4-0ubuntu12.30.5-0ubuntu12.30.6-12.30.7-0ubuntu12.30.7-0ubuntu1.12.30.7-0ubuntu1.22.30.7-0ubuntu1.62.30.7-0ubuntu1.7 |
2.30.7-0ubuntu1.8 |
gdk-pixbufUbuntu:16.04:LTS |
before 2.32.2-1ubuntu1.4, plus listed versions 2.32.1-12.32.2-12.32.2-1ubuntu12.32.2-1ubuntu1.22.32.2-1ubuntu1.3 |
2.32.2-1ubuntu1.4 |
gdk-pixbufUbuntu:14.04:LTS From an advisory covering 4 CVEs |
before 2.30.7-0ubuntu1.8, plus listed versions 2.28.1-1ubuntu22.30.0-0ubuntu22.30.1-0ubuntu22.30.2-0ubuntu12.30.2-0ubuntu2 Show 9 moreShow less2.30.3-0ubuntu12.30.4-0ubuntu12.30.5-0ubuntu12.30.6-12.30.7-0ubuntu12.30.7-0ubuntu1.12.30.7-0ubuntu1.22.30.7-0ubuntu1.62.30.7-0ubuntu1.7 |
2.30.7-0ubuntu1.8 |
gdk-pixbufUbuntu:16.04:LTS From an advisory covering 4 CVEs |
before 2.32.2-1ubuntu1.4, plus listed versions 2.32.1-12.32.2-12.32.2-1ubuntu12.32.2-1ubuntu1.22.32.2-1ubuntu1.3 |
2.32.2-1ubuntu1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1000422 is a high vulnerability (CVSS 8.8) in Gnome Gdk-pixbuf, published January 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.02%, the 81st percentile. Fixed in gdk-pixbuf 2.36.11-1.
References
bugzilla.gnome.org/show_bug.cgi?id=785973
debian.org/security/2018/dsa-4088
usn.ubuntu.com/3532-1
lists.debian.org/debian-lts-announce/2018/01/msg00007.html
security.gentoo.org/glsa/201804-14
nvd.nist.gov/vuln/detail/CVE-2017-1000422
Show 16 moreShow less
github.com/advisories/GHSA-245r-96m5-w336
security-tracker.debian.org/tracker/CVE-2017-1000422
advisories.mageia.org/MGASA-2018-0087.html
bugs.mageia.org/show_bug.cgi?id=22399
suse.com/support/update/announcement/2018/suse-su-20181950-1
bugzilla.suse.com/1074462
ubuntu.com/security/CVE-2017-1000422
cve.org/CVERecord?id=CVE-2017-1000422