Information Exposure Affecting gdk-pixbuf2-modules package, versions *


Severity

Recommended
0.0
low
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.01% (2nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-GDKPIXBUF2MODULES-10374862
  • published17 Jun 2025
  • disclosed17 Jun 2025

Introduced: 17 Jun 2025

NewCVE-2025-6199  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:8 gdk-pixbuf2-modules.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gdk-pixbuf2-modules package and not the gdk-pixbuf2-modules package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.

CVSS Base Scores

version 3.1