CVE catalog

CVE-2020-29385

gdk-pixbuf: CVE-2020-29385

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.54% · Oct 25, 2026

GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangdk-pixbufsid2.44.8+dfsg-1fixed
Debiangdk-pixbufforky2.44.8+dfsg-1fixed
Debiangdk-pixbuftrixie2.42.12+dfsg-4+deb13u1fixed
Debiangdk-pixbuftrixie-security2.42.12+dfsg-4+deb13u1fixed
Debiangdk-pixbufbookworm2.42.10+dfsg-1+deb12u4fixed
Debiangdk-pixbufbookworm-security2.42.10+dfsg-1+deb12u4fixed
Alpinegdk-pixbuf3.112.40.0-r2fixed
Alpinegdk-pixbuf3.122.40.0-r4fixed
Alpinegdk-pixbuf3.132.42.2-r0fixed
Alpinegdk-pixbuf3.142.42.2-r0fixed
Alpinegdk-pixbuf3.152.42.2-r0fixed
Alpinegdk-pixbuf3.162.42.2-r0fixed
Alpinegdk-pixbuf3.172.42.2-r0fixed
Alpinegdk-pixbuf3.182.42.2-r0fixed
Alpinegdk-pixbuf3.192.42.2-r0fixed
Alpinegdk-pixbuf3.202.42.2-r0fixed
Alpinegdk-pixbuf3.212.42.2-r0fixed
Alpinegdk-pixbuf3.222.42.2-r0fixed
Alpinegdk-pixbuf3.232.42.2-r0fixed
Ubuntugdk-pixbuf20.042.40.0+dfsg-1build1vulnerable
Ubuntugdk-pixbuf20.042.40.0+dfsg-1ubuntu1vulnerable
Ubuntugdk-pixbuf20.042.40.0+dfsg-2vulnerable
Ubuntugdk-pixbuf20.042.40.0+dfsg-3vulnerable
Ubuntugdk-pixbuf20.042.40.0+dfsg-3ubuntu0.1fixed
Ubuntugdk-pixbuf20.042.40.0+dfsg-1build1vulnerable
Ubuntugdk-pixbuf20.042.40.0+dfsg-1ubuntu1vulnerable
Ubuntugdk-pixbuf20.042.40.0+dfsg-2vulnerable
Ubuntugdk-pixbuf20.042.40.0+dfsg-3vulnerable
Ubuntugdk-pixbuf20.042.40.0+dfsg-3ubuntu0.1fixed
Opensusegdk-pixbufleap 15.22.40.0-lp152.2.3.1fixed
Susegdk-pixbuflinux enterprise module for basesystem 15 sp22.40.0-3.3.1fixed
Susegdk-pixbuflinux enterprise module for desktop applications 15 sp22.40.0-3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangdk-pixbufsourcesid2.42.2+dfsg-1not yet assignedNot reported[977166]
Debiangdk-pixbufsourceforky2.42.2+dfsg-1not yet assignedNot reported[977166]
Debiangdk-pixbufsourcetrixie2.42.2+dfsg-1not yet assignedNot reported[977166]
Debiangdk-pixbufsourcebookworm2.42.2+dfsg-1not yet assignedNot reported[977166]
Alpinegdk-pixbufapk3.112.40.0-r2Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.122.40.0-r4Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.132.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.142.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.152.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.162.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.172.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.182.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.192.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.202.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.212.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.222.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Alpinegdk-pixbufapk3.232.42.2-r0Not reportedALPINE-CVE-2020-29385Not reported
Ubuntugdk-pixbufdeb20.042.40.0+dfsg-3ubuntu0.1Not reportedUBUNTU-CVE-2020-29385Not reported
Ubuntugdk-pixbufdeb20.042.40.0+dfsg-3ubuntu0.1Not reportedUSN-4663-1Not reported
Opensusegdk-pixbufrpmleap 15.22.40.0-lp152.2.3.1Not reportedOPENSUSE-SU-2021:0150-1Not reported
Susegdk-pixbufrpmlinux enterprise module for basesystem 15 sp22.40.0-3.3.1Not reportedSUSE-SU-2021:0184-1Not reported
Susegdk-pixbufrpmlinux enterprise module for desktop applications 15 sp22.40.0-3.3.1Not reportedSUSE-SU-2021:0184-1Not reported

[Debian bug #977166]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [gdk-pixbuf-tests]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

  • [gir1.2-gdkpixbuf-2.0]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf-2.0-0]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf2.0-bin]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf2.0-common]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf-2.0-dev]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

  • [libgdk-pixbuf2.0-doc]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

    • 2.42.10+dfsg-1+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · bookworm; dsa · gdk-pixbuf · debian · 12

[Debian 13 (Trixie)]

  • [gdk-pixbuf-tests]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

  • [gir1.2-gdkpixbuf-2.0]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

  • [libgdk-pixbuf-2.0-0]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

  • [libgdk-pixbuf2.0-bin]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

  • [libgdk-pixbuf2.0-common]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · all · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · all · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

  • [libgdk-pixbuf-2.0-dev]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

  • [libgdk-pixbuf2.0-doc]Unknown

    Source package: [gdk-pixbuf]

    Details (4)

    • 2.42.12+dfsg-4+deb13u1 · all · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · all · trixie

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

    • 2.42.12+dfsg-4+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.42.2+dfsg-1

      dsa · gdk-pixbuf · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]