GTK+ Insecure Library Loading Vulnerability
Last Update Date:
16 Dec 2011
Release Date:
6 Sep 2011
5141
Views
RISK: High Risk
TYPE: Clients - Graphics & Design
A vulnerability has been identified in GTK+, which can be exploited by malicious people to compromise an application using the library.
The vulnerability is caused due to the "_gdk_input_wintab_init_check()" (gdk/win32/gdkinput-win32.c) and the "xp_theme_init()" functions (modules/engines/ms-windows/xp_theme.c) loading libraries (wintab32.dll and uxtheme.dll) in an insecure manner. This can be exploited to load arbitrary libraries when an application using this library e.g. opens a file located on a remote WebDAV or SMB share.
Successful exploitation may allow execution of arbitrary code.
Impact
- Remote Code Execution
System / Technologies affected
- GTK+ 2.x
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Update to version 2.24.0.
Vulnerability Identifier
Source
Related Link
Share with