Homepage

Loop with Unreachable Exit Condition ('Infinite Loop') The advisory has been revoked - it doesn't affect any version of package gdk-pixbuf  (opens in a new tab)

Threat Intelligence

EPSS
0.17% (55th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1804-GDKPIXBUF-1048826
  • published8 Dec 2020
  • disclosed26 Dec 2020
Report a new vulnerability Found a mistake?

Introduced: 8 Dec 2020

CVE-2020-29385  (opens in a new tab)
CWE-835  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:18.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gdk-pixbuf package and not the gdk-pixbuf package as distributed by Ubuntu.

GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.

References