CVE-2017-6314

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/21/4Exploit, Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/26/1Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/96779Third Party Advisory, VDB Entry
https://bugzilla.gnome.org/show_bug.cgi?id=779020Exploit, Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00025.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJF5ARFOX4BFUK6YCBKGAKBQYECO3AI2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSAZ6UCKKXC5VOWXGWQHOX2ZBLLATIOT/
https://security.gentoo.org/glsa/201709-08Third Party Advisory
http://mov.sx/2017/02/21/bug-hunting-gdk-pixbuf.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/21/4Exploit, Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/26/1Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/96779Third Party Advisory, VDB Entry
https://bugzilla.gnome.org/show_bug.cgi?id=779020Exploit, Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00025.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJF5ARFOX4BFUK6YCBKGAKBQYECO3AI2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSAZ6UCKKXC5VOWXGWQHOX2ZBLLATIOT/
https://security.gentoo.org/glsa/201709-08Third Party Advisory

Timeline

Published: Mar 10, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-63159.8Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx.CVE-2017-63169.8Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID CVE-2017-63176.5Memory leak in the add_shader_program function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a deni CVE-2017-63187.5saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted SANE_NET_CONTROL_OPTION packet.CVE-2017-63197.8The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer over CVE-2017-63208.8A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1 CVE-2017-63238.0The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a CVE-2017-63247.3The Symantec Messaging Gateway, when processing a specific email attachment, can allow a malformed or corrupted Word file with a potentially CVE-2017-63256.6The Symantec Messaging Gateway can encounter a file inclusion vulnerability, which is a type of vulnerability that is most commonly found to CVE-2017-632610.0The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain CVE-2017-63278.8The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an ind CVE-2017-63288.8The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is