CVE-2021-46829 Memory corruption in n/a

High 7.8 Published 24 Jul 2022 Updated 4 Aug 2024

A heap-based buffer overflow in GDK-PixBuf allows attackers to execute arbitrary code via crafted GIF files, particularly on 32-bit systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-46829?

CVE-2021-46829 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 24 Jul 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit systems.

Weakness: CWE-190

Which versions are affected by CVE-2021-46829?

It affects 3 products.

Linux distribution packages (8)

`gdk-pixbuf` SUSE:Linux Enterprise Micro 5.2	All versions	`2.40.0-150200.3.6.1`
`gdk-pixbuf` SUSE:Linux Enterprise Module for Basesystem 15 SP3	All versions	`2.40.0-150200.3.6.1`
`gdk-pixbuf` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`2.42.8-150400.5.3.1`
`gdk-pixbuf` SUSE:Linux Enterprise Module for Desktop Applications 15 SP3	All versions	`2.40.0-150200.3.6.1`
`gdk-pixbuf` openSUSE:Leap 15.3	All versions	`2.40.0-150200.3.6.1`
`gdk-pixbuf` openSUSE:Leap 15.4	All versions	`2.42.8-150400.5.3.1`
`gdk-pixbuf` openSUSE:Leap Micro 5.2	All versions	`2.40.0-150200.3.6.1`
`gdk-pixbuf` openSUSE:Tumbleweed	All versions	`2.42.8-2.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Gnome Gdk-Pixbuf.

How do I fix CVE-2021-46829?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-46829 being exploited?

There is no known exploitation of CVE-2021-46829 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-46829, GHSA-xq3g-5rhc-pxgj, MGASA-2022-0269, OESA-2022-1873, OESA-2022-1874, SUSE-SU-2022:2995-1 and 4 more.