{"id":"CVE-2021-44648","aliases":["ALPINE-CVE-2021-44648","ALSA-2023:2216","BELL-CVE-2021-44648","DEBIAN-CVE-2021-44648","DSA-5228-1","EUVD-2021-31469","GHSA-hm7g-c3p8-8xwf","MGASA-2022-0402","RHSA-2023:2216","SUSE-SU-2022:3153-1","SUSE-SU-2022:3230-1","UBUNTU-CVE-2021-44648","USN-5607-1","openSUSE-SU-2024:12296-1"],"status":"published","title":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the...","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01969,"percentile":0.80567,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-01-12T12:31:26Z","modified":"2026-11-03T06:32:47Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gdk-pixbuf","fixed_in":["2.42.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gdk-pixbuf","fixed_in":["2.42.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gdk-pixbuf","fixed_in":["2.42.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gdk-pixbuf","fixed_in":["2.42.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"gdk-pixbuf2.0","fixed_in":["2.42.2-1.2.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"gdk-pixbuf","fixed_in":["2.42.9-150400.5.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"gdk-pixbuf","fixed_in":["2.42.9-150400.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"gdk-pixbuf","fixed_in":["2.40.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gdk-pixbuf","fixed_in":["2.40.0+dfsg-3ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gdk-pixbuf","fixed_in":["2.42.8+dfsg-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gdk-pixbuf","fixed_in":["2.42.9-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gdk-pixbuf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gdk-pixbuf2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gdk-pixbuf2-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.9+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.2+dfsg-1+deb11u1"}]}],"versions":["2.42.2+dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"gdk-pixbuf2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.2-1.2.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gdk-pixbuf2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gdk-pixbuf2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gdk-pixbuf2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gdk-pixbuf2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gdk-pixbuf2-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gdk-pixbuf2-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gdk-pixbuf2-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gdk-pixbuf2-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.42.6-3.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.9-150400.5.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.9-150400.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0+dfsg-3ubuntu0.4"}]}],"versions":["2.40.0+dfsg-1build1","2.40.0+dfsg-1ubuntu1","2.40.0+dfsg-2","2.40.0+dfsg-3","2.40.0+dfsg-3ubuntu0.1","2.40.0+dfsg-3ubuntu0.2","2.40.0+dfsg-3ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8+dfsg-1ubuntu0.1"}]}],"versions":["2.42.6+dfsg-1build2","2.42.6+dfsg-1build3","2.42.6+dfsg-2ubuntu2","2.42.6+dfsg-2ubuntu3","2.42.8+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.0+dfsg-3ubuntu0.4"}]}],"versions":["2.40.0+dfsg-1build1","2.40.0+dfsg-1ubuntu1","2.40.0+dfsg-2","2.40.0+dfsg-3","2.40.0+dfsg-3ubuntu0.1","2.40.0+dfsg-3ubuntu0.2","2.40.0+dfsg-3ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.8+dfsg-1ubuntu0.1"}]}],"versions":["2.42.6+dfsg-1build2","2.42.6+dfsg-1build3","2.42.6+dfsg-2ubuntu2","2.42.6+dfsg-2ubuntu3","2.42.8+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.9-3.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnome","product":"gdkpixbuf"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/136","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://sahildhar.github.io/blogpost/GdkPixbuf-Heap-Buffer-Overflow-in-lzw_decoder_new/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEVTOGIJITK2N5AOOLKKMDIICZDQE6CH/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2022/dsa-5228","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44648","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEVTOGIJITK2N5AOOLKKMDIICZDQE6CH/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/"},{"url":"https://github.com/advisories/GHSA-hm7g-c3p8-8xwf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-44648","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2216","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44648","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46829","tags":["report"]},{"url":"https://bugzilla.redhat.com/2043722","tags":["report"]},{"url":"https://bugzilla.redhat.com/2114940","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2216.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-44648","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-44648","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0402.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30045","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/PEKBMOO52RXONWKB6ZKKHTVPLF6WC3KF/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LAG7HNTW3KWGP2EF5FBPHDA3R5UPDYZY/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5607-1","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2114940","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2216.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44648","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46829","tags":["advisory"]},{"url":"https://github.com/pedrib/PoC/blob/master/fuzzing/CVE-2021-46829/CVE-2021-46829.md","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2022/07/23/1","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223153-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194633","tags":["report"]},{"url":"https://bugzilla.suse.com/1195391","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44648","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223230-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-44648","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-44648","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.","status":"published","published":"2022-01-12T12:31:26Z","modified":"2024-08-04T04:25:16.838Z","updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-31469","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.","status":"published","published":"2022-01-12T12:31:26Z","modified":"2024-08-04T04:25:16Z","updated_at":"2026-11-03T03:08:28.560815Z"}],"ghsa":[{"id":"GHSA-hm7g-c3p8-8xwf","title":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the...","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.","status":"published","published":"2022-02-15T00:03:24Z","modified":"2023-01-30T05:02:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:46:34.725436Z"}],"nvd":[{"id":"CVE-2021-44648","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.","status":"published","published":"2022-01-12T13:15:07.687Z","modified":"2026-06-17T04:12:38.243Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:03.418194Z"}],"osv":[{"id":"ALPINE-CVE-2021-44648","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.","status":"published","published":"2022-01-12T13:15:07.687Z","modified":"2026-11-03T06:32:47.993772883Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"BELL-CVE-2021-44648","title":"CVE-2021-44648 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:27.972623Z","modified":"2026-01-26T10:04:56.718138Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-44648","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.","status":"published","published":"2022-01-12T13:15:07.687Z","modified":"2026-10-24T10:51:25.834730284Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-44648","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.","status":"published","published":"2022-01-12T13:15:07.687Z","modified":"2026-10-23T18:04:16.996514717Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"RHSA-2023:2216","title":"Red Hat Security Advisory: gdk-pixbuf2 security update","status":"published","published":"2024-09-16T09:32:53Z","modified":"2025-11-22T12:49:08Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"UBUNTU-CVE-2021-44648","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.","status":"published","published":"2022-01-12T13:15:00Z","modified":"2026-04-22T13:04:18.568009Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"ALSA-2023:2216","title":"Moderate: gdk-pixbuf2 security update","description":"The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.\n\nSecurity Fix(es):\n\n* gdk-pixbuf: heap-buffer overflow when decoding the lzw compressed stream of image data (CVE-2021-44648)\n* gdk-pixbuf: heap-based buffer overflow when compositing or clearing frames in GIF files (CVE-2021-46829)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:54.313311445Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"DSA-5228-1","title":"gdk-pixbuf - security update","status":"published","published":"2022-09-11T00:00:00Z","modified":"2026-03-09T02:10:17.064258Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0402","title":"Updated gdk-pixbuf2.0 packages fix security vulnerability","description":"GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow\nvulnerability when decoding the lzw compressed stream of image data in GIF\nfiles with lzw minimum code size equals to 12. (CVE-2021-44648)\n","status":"published","published":"2022-11-01T22:58:59Z","modified":"2026-04-16T04:44:30.190934525Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12296-1","title":"gdk-pixbuf-devel-2.42.9-3.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-devel-2.42.9-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:50:23.446499Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:3153-1","title":"Security update for gdk-pixbuf","description":"This update for gdk-pixbuf fixes the following issues:\n\nUpdate to version 2.42.9:\n- CVE-2021-44648: Fixed overflow vulnerability in lzw code size (bsc#1194633).\n\nBugfixes:\n- Fixed loading of larger images (glgo#GNOME/gdk-pixbuf#216).\n- Avoided bashism in baselibs postscript (bsc#1195391).\n","status":"published","published":"2022-09-07T12:31:21Z","modified":"2025-05-02T04:31:58.617552Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3230-1","title":"Security update for gdk-pixbuf","description":"This update for gdk-pixbuf fixes the following issues:\n\n- CVE-2021-44648: Fixed overflow vulnerability in lzw code size (bsc#1194633).\n","status":"published","published":"2022-09-09T12:48:21Z","modified":"2026-02-04T03:49:40.585764Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5607-1","title":"gdk-pixbuf vulnerability","description":"It was discovered that GDK-PixBuf incorrectly handled certain images.\nAn attacker could possibly use this issue to execute arbitrary code\nor cause a crash.\n","status":"published","published":"2022-09-13T14:35:00Z","modified":"2026-04-22T10:27:32.672256Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}