p PatchFirst

CVE-2025-6199

CVE-2025-6199 · Gdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decoder

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed image.

CVSS 3.3 · Low · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • gdk-pixbuf Debian:12

    Versions
    • 2.42.10+dfsg-1
    • 2.42.10+dfsg-1+deb12u1
    Affected ranges
    • ECOSYSTEM: < 2.42.10+dfsg-1+deb12u2

    Update to 2.42.10+dfsg-1+deb12u2

  • gdk-pixbuf Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.42.12+dfsg-3

    Update to 2.42.12+dfsg-3

  • gdk-pixbuf Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.42.12+dfsg-3

    Update to 2.42.12+dfsg-3

  • gdk-pixbuf Ubuntu:Pro:16.04:LTS

    Versions
    • 2.32.1-1
    • 2.32.2-1
    • 2.32.2-1ubuntu1
    • 2.32.2-1ubuntu1.2
    • 2.32.2-1ubuntu1.3
    • 2.32.2-1ubuntu1.4
    • 2.32.2-1ubuntu1.5
    • 2.32.2-1ubuntu1.6
    • 2.32.2-1ubuntu1.6+esm1
    Affected ranges
    • ECOSYSTEM: < 2.32.2-1ubuntu1.6+esm2

    Update to 2.32.2-1ubuntu1.6+esm2

  • gdk-pixbuf Ubuntu:Pro:18.04:LTS

    Versions
    • 2.36.11-1
    • 2.36.11-1ubuntu0.1
    • 2.36.11-2
    • 2.36.11-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 2.36.11-2ubuntu0.1~esm2

    Update to 2.36.11-2ubuntu0.1~esm2

  • gdk-pixbuf Ubuntu:Pro:20.04:LTS

    Versions
    • 2.40.0+dfsg-1build1
    • 2.40.0+dfsg-1ubuntu1
    • 2.40.0+dfsg-2
    • 2.40.0+dfsg-3
    • 2.40.0+dfsg-3ubuntu0.1
    • 2.40.0+dfsg-3ubuntu0.2
    • 2.40.0+dfsg-3ubuntu0.3
    • 2.40.0+dfsg-3ubuntu0.4
    • 2.40.0+dfsg-3ubuntu0.5
    Affected ranges
    • ECOSYSTEM: < 2.40.0+dfsg-3ubuntu0.5+esm1

    Update to 2.40.0+dfsg-3ubuntu0.5+esm1

  • gdk-pixbuf Ubuntu:22.04:LTS

    Versions
    • 2.42.6+dfsg-1build2
    • 2.42.6+dfsg-1build3
    • 2.42.6+dfsg-2ubuntu2
    • 2.42.6+dfsg-2ubuntu3
    • 2.42.8+dfsg-1
    • 2.42.8+dfsg-1ubuntu0.1
    • 2.42.8+dfsg-1ubuntu0.2
    • 2.42.8+dfsg-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 2.42.8+dfsg-1ubuntu0.4

    Update to 2.42.8+dfsg-1ubuntu0.4

  • gdk-pixbuf Ubuntu:24.04:LTS

    Versions
    • 2.42.10+dfsg-1build1
    • 2.42.10+dfsg-3
    • 2.42.10+dfsg-3ubuntu1
    • 2.42.10+dfsg-3ubuntu2
    • 2.42.10+dfsg-3ubuntu3
    • 2.42.10+dfsg-3ubuntu3.1
    Affected ranges
    • ECOSYSTEM: < 2.42.10+dfsg-3ubuntu3.2

    Update to 2.42.10+dfsg-3ubuntu3.2

  • gdk-pixbuf Ubuntu:25.10

    Versions
    • 2.42.12+dfsg-2
    • 2.42.12+dfsg-3
    Affected ranges
    • ECOSYSTEM: < 2.42.12+dfsg-4build1

    Update to 2.42.12+dfsg-4build1

Original sources

Check your server →