CVE catalog

CVE-2013-7447

gtk+2.0: CVE-2013-7447

Severity: Medium · CVSS 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Feb 15, 2016, 6:20:17 PM UTC
Source: [NVD] · [CVE record]
EPSS: 4.63% · Oct 25, 2026

Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allows remote attackers to cause a denial of service (crash) via a large image file, which triggers a large memory allocation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gtk+2.0	sid	`2.24.33-10`	fixed
Debian	gtk+2.0	forky	`2.24.33-10`	fixed
Debian	gtk+2.0	trixie	`2.24.33-7`	fixed
Debian	gtk+2.0	bookworm	`2.24.33-2+deb12u1`	fixed
Debian	gtk+3.0	sid	`3.24.52-3`	fixed
Debian	gtk+3.0	forky	`3.24.52-3`	fixed
Debian	gtk+3.0	trixie	`3.24.49-3`	fixed
Debian	gtk+3.0	bookworm	`3.24.38-2~deb12u3`	fixed
Ubuntu	gtk+2.0	14.04	`2.24.20-1ubuntu1`	vulnerable
Ubuntu	gtk+2.0	14.04	`2.24.21-1ubuntu1`	vulnerable
Ubuntu	gtk+2.0	14.04	`2.24.22-1ubuntu1`	vulnerable
Ubuntu	gtk+2.0	14.04	`2.24.22-1ubuntu2`	vulnerable
Ubuntu	gtk+2.0	14.04	`2.24.23-0ubuntu1`	vulnerable
Ubuntu	gtk+2.0	14.04	`2.24.23-0ubuntu1.1`	vulnerable
Ubuntu	gtk+2.0	14.04	`2.24.23-0ubuntu1.2`	vulnerable
Ubuntu	gtk+2.0	14.04	`2.24.23-0ubuntu1.3`	vulnerable
Ubuntu	gtk+2.0	14.04	`2.24.23-0ubuntu1.4`	fixed
Ubuntu	eog	14.04	`3.8.2-1ubuntu1`	vulnerable
Ubuntu	eog	14.04	`3.10.1-1ubuntu1`	vulnerable
Ubuntu	eog	14.04	`3.10.2-0ubuntu1`	vulnerable
Ubuntu	eog	14.04	`3.10.2-0ubuntu2`	vulnerable
Ubuntu	eog	14.04	`3.10.2-0ubuntu3`	vulnerable
Ubuntu	eog	14.04	`3.10.2-0ubuntu4`	vulnerable
Ubuntu	eog	14.04	`3.10.2-0ubuntu5`	vulnerable
Ubuntu	eog	14.04	`3.10.2-0ubuntu5.1`	fixed
Opensuse	lasem	tumbleweed	`0.4.4-2.13`	fixed
Opensuse	eog	tumbleweed	`3.20.5-1.1`	fixed
Suse	gtk2	linux enterprise desktop 12 sp1	`2.24.24-3.1`	fixed
Suse	gtk2	linux enterprise software development kit 12 sp1	`2.24.24-3.1`	fixed
Suse	gtk2	linux enterprise server 12 sp1	`2.24.24-3.1`	fixed
Suse	gtk2	linux enterprise server for sap applications 12 sp1	`2.24.24-3.1`	fixed
Suse	gtk2	linux enterprise workstation extension 12 sp1	`2.24.24-3.1`	fixed
Suse	gtk2	linux enterprise software development kit 11 sp4	`2.18.9-0.44.1`	fixed
Suse	gtk2	linux enterprise server 11 sp4	`2.18.9-0.44.1`	fixed
Suse	gtk2	linux enterprise server for sap applications 11 sp4	`2.18.9-0.44.1`	fixed
Opensuse	gtk2	tumbleweed	`2.24.31-1.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gtk+2.0	source	sid	`2.24.30-1.1`	not yet assigned	Not reported	[799275]
Debian	gtk+2.0	source	forky	`2.24.30-1.1`	not yet assigned	Not reported	[799275]
Debian	gtk+2.0	source	trixie	`2.24.30-1.1`	not yet assigned	Not reported	[799275]
Debian	gtk+2.0	source	bookworm	`2.24.30-1.1`	not yet assigned	Not reported	[799275]
Debian	gtk+3.0	source	sid	`3.10.7-1`	not yet assigned	Not reported	[818090]
Debian	gtk+3.0	source	forky	`3.10.7-1`	not yet assigned	Not reported	[818090]
Debian	gtk+3.0	source	trixie	`3.10.7-1`	not yet assigned	Not reported	[818090]
Debian	gtk+3.0	source	bookworm	`3.10.7-1`	not yet assigned	Not reported	[818090]
Ubuntu	gtk+2.0	deb	14.04	`2.24.23-0ubuntu1.4`	Not reported	USN-2898-1	Not reported
Ubuntu	eog	deb	14.04	`3.10.2-0ubuntu5.1`	Not reported	USN-2898-2	Not reported
Opensuse	lasem	rpm	tumbleweed	`0.4.4-2.13`	Not reported	OPENSUSE-SU-2024:10908-1	Not reported
Opensuse	eog	rpm	tumbleweed	`3.20.5-1.1`	Not reported	OPENSUSE-SU-2024:10170-1	Not reported
Suse	gtk2	rpm	linux enterprise desktop 12 sp1	`2.24.24-3.1`	Not reported	SUSE-SU-2016:2550-1	Not reported
Suse	gtk2	rpm	linux enterprise software development kit 12 sp1	`2.24.24-3.1`	Not reported	SUSE-SU-2016:2550-1	Not reported
Suse	gtk2	rpm	linux enterprise server 12 sp1	`2.24.24-3.1`	Not reported	SUSE-SU-2016:2550-1	Not reported
Suse	gtk2	rpm	linux enterprise server for sap applications 12 sp1	`2.24.24-3.1`	Not reported	SUSE-SU-2016:2550-1	Not reported
Suse	gtk2	rpm	linux enterprise workstation extension 12 sp1	`2.24.24-3.1`	Not reported	SUSE-SU-2016:2550-1	Not reported
Suse	gtk2	rpm	linux enterprise software development kit 11 sp4	`2.18.9-0.44.1`	Not reported	SUSE-SU-2016:2532-1	Not reported
Suse	gtk2	rpm	linux enterprise server 11 sp4	`2.18.9-0.44.1`	Not reported	SUSE-SU-2016:2532-1	Not reported
Suse	gtk2	rpm	linux enterprise server for sap applications 11 sp4	`2.18.9-0.44.1`	Not reported	SUSE-SU-2016:2532-1	Not reported
Opensuse	gtk2	rpm	tumbleweed	`2.24.31-1.2`	Not reported	OPENSUSE-SU-2024:10522-1	Not reported

[Debian bug #799275][Debian bug #818090]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[eog-devel]Unknown
Source package: [eog]
Details (1)
- 50.2-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 3.20.5-1.1
  Version impact unknown
  dsa · eog · opensuse · tumbleweed
[eog-lang]Unknown
Source package: [eog]
Details (1)
- 50.2-1.3 · noarch · tumbleweed
  Unknown · Fixed: 3.20.5-1.1
  Version impact unknown
  dsa · eog · opensuse · tumbleweed
[gtk2-branding-upstream]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · noarch · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-data]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · noarch · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-devel]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-devel-32bit]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-amharic]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-amharic-32bit]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-inuktitut]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-inuktitut-32bit]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-multipress]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-multipress-32bit]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-thai]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-thai-32bit]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-tigrigna]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-tigrigna-32bit]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-vietnamese]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-vietnamese-32bit]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-xim]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed
[gtk2-immodule-xim-32bit]Unknown
Source package: [gtk2]
Details (1)
- 2.24.33-18.6 · x86_64 · tumbleweed
  Unknown · Fixed: 2.24.31-1.2
  Version impact unknown
  dsa · gtk2 · opensuse · tumbleweed

Next results

Observed: Oct 23, 2026, 5:09:33 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]