[GDK] patch - avoid integer overflow when allocating a large block of memory

The attachment "debdiff with the fix for Precise" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

Thank you for your work. I've sponsored the xenial update (with a modified changelog, we don't have designed maintainers/NMUs in Ubuntu, also I tweaked the version number to not be .1 and listed the bug reference).

Once the update gets some testing in xenial we can look at the SRUs

Note that it would be nice to suggest to upstream that they backport the change to gtk-2-24 since they still roll updates to gtk2 sometimes and it could benefit users of other distros that way

Do you know if this issue has a CVE assigned yet? I didn't see one in the linked bug reports but those references may not have migrated to those sources yet.

Thanks

I've requested CVEs here http://www.openwall.com/lists/oss-security/2016/02/10/2

It appears this flaw was copy-pasted to a lot of programs.

Thanks

This bug was fixed in the package gtk+2.0 - 2.24.29-1ubuntu2

---------------
gtk+2.0 (2.24.29-1ubuntu2) xenial; urgency=medium

  * gdkcairo-Avoid-integer-overflow.patch: new patch. Cherry-pick upstream
    commit from GTK+3 to avoid integer overflow when allocating a large block
    of memory in gdk_cairo_set_source_pixbuf. (lp: #1540811)

 -- Vlad Orlov <email address hidden> Tue, 02 Feb 2016 10:52:16 +0300

Since this is a security update, I'll sponsor these as security updates, and not as SRUs.

This bug was fixed in the package gtk+2.0 - 2.24.10-0ubuntu6.3

---------------
gtk+2.0 (2.24.10-0ubuntu6.3) precise-security; urgency=low

  * gdkcairo-Avoid-integer-overflow.patch: new patch. Cherry-pick upstream
    commit from GTK+3 to avoid integer overflow when allocating a large block
    of memory in gdk_cairo_set_source_pixbuf. (LP: #1540811)
    - CVE-2013-7447

 -- Vlad Orlov <email address hidden> Tue, 22 Sep 2015 09:51:11 +0300

This bug was fixed in the package gtk+2.0 - 2.24.23-0ubuntu1.4

---------------
gtk+2.0 (2.24.23-0ubuntu1.4) trusty-security; urgency=medium

  * gdkcairo-Avoid-integer-overflow.patch: new patch. Cherry-pick upstream
    commit from GTK+3 to avoid integer overflow when allocating a large block
    of memory in gdk_cairo_set_source_pixbuf. (LP: #1540811)
    - CVE-2013-7447

 -- Vlad Orlov <email address hidden> Tue, 22 Sep 2015 11:09:21 +0300

This bug was fixed in the package gtk+3.0 - 3.4.2-0ubuntu0.9

---------------
gtk+3.0 (3.4.2-0ubuntu0.9) precise-security; urgency=medium

  * SECURITY UPDATE: integer overflow via large sized image (LP: #1540811)
    - debian/patches/CVE-2013-7447.patch: use g_malloc_n in
      gdk_cairo_set_source_pixbuf in gdk/gdkcairo.c.
    - CVE-2013-7447

 -- Marc Deslauriers <email address hidden> Fri, 12 Feb 2016 08:37:18 -0500

This bug was fixed in the package gtk+2.0 - 2.24.28-1ubuntu1.1

---------------
gtk+2.0 (2.24.28-1ubuntu1.1) wily-security; urgency=medium

  * gdkcairo-Avoid-integer-overflow.patch: new patch. Cherry-pick upstream
    commit from GTK+3 to avoid integer overflow when allocating a large block
    of memory in gdk_cairo_set_source_pixbuf. (LP: #1540811)
    - CVE-2013-7447

 -- Vlad Orlov <email address hidden> Tue, 22 Sep 2015 13:27:04 +0300

Thank you guys!
Hope someone from Debian maintainers will take care of it as well...