CVE-2007-0010 Denial of service in n/a

Low 2.1 Published 24 Jan 2007 Updated 7 Aug 2024

Attackers can cause a denial of service via a malformed image file processed by the GTK+ library, requiring user interaction to open the file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2007-0010?

CVE-2007-0010 is a low-severity denial of service vulnerability in n/a, published on 24 Jan 2007. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The GdkPixbufLoader function in GIMP ToolKit (GTK+) in GTK 2 (gtk2) before 2.4.13 allows context-dependent attackers to cause a denial of service (crash) via a malformed image file.

Which versions are affected by CVE-2007-0010?

It affects 1 product.

Linux distribution packages (12)

`gtk2` Red Hat:enterprise_linux:4::as	All versions	`0:2.4.13-22`
`gtk2-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:2.4.13-22`
`gtk2-devel` Red Hat:enterprise_linux:4::as	All versions	`0:2.4.13-22`
`gtk2` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.4.13-22`
`gtk2-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.4.13-22`
`gtk2-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.4.13-22`
`gtk2` Red Hat:enterprise_linux:4::es	All versions	`0:2.4.13-22`
`gtk2-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:2.4.13-22`
`gtk2-devel` Red Hat:enterprise_linux:4::es	All versions	`0:2.4.13-22`
`gtk2` Red Hat:enterprise_linux:4::ws	All versions	`0:2.4.13-22`
`gtk2-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:2.4.13-22`
`gtk2-devel` Red Hat:enterprise_linux:4::ws	All versions	`0:2.4.13-22`

Products include Gnome Gtk.

How do I fix CVE-2007-0010?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2007-0010 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-0010 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as DEBIAN-CVE-2007-0010, DSA-1256-1, GHSA-p8m8-7wqx-pmvj, RHSA-2007:0019.