CVE-2020-29385

Katalog CVE

CVSS 5.5 · Medium EPSS 1,5%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada gnome gdk-pixbuf, canonical ubuntu linux +1 lainnya. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.

Rincian

Terbit di NVD

26 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/blob/master/NEWS release notes · advisory vendor
• https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/164 advisory vendor
• https://ubuntu.com/security/CVE-2020-29385 patch · advisory pihak ketiga
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=977166 issue tracking · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5H3GNVWMZTYZ... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BGZVCTH5O7WBJ... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EANWYODLOJDFL... mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202012-15 advisory pihak ketiga