CVE-2016-6352: canonical ubuntu_linux Out-of-bounds Write

Modified

AliasesMGASA-2016-0322UBUNTU-CVE-2016-6352DEBIAN-CVE-2016-6352

Published 03-10-2016Last modified 06-08-2024

Vulnerability summary

CVE-2016-6352 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 3.85% chance of exploitation in the next 30 days, higher than 90.1% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.0 (NVD)

EPSS score

3.85%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 4 · Related 3

DLA-2043-1 OPENSUSE-SU-2024:10453-1 SUSE-SU-2016:2532-1 USN-3085-1

Timeline

03-10-2016
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.07.5v2.05.0

EPSS trend

Probability

3.85%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.85% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (git.gnome.org)
Maturity: unknown
referenceUnverified
Exploit Reference (bugzilla.gnome.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Opensuse2 products

leapEOL42.1
opensuseEOL13.2

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04

Debian1 product

gdk-pixbuf< 2.35.4-1

Gnome1 product

gdk-pixbuf≤ 2.35.2

Mageia1 product

gdk-pixbuf2.0< 2.32.3-1.mga5

Ubuntu1 product

gdk-pixbuf< 2.30.7-0ubuntu1.6 | < 2.32.2-1ubuntu1.2

6 vendors · 7 products

References

17 links

www.openwall.com/lists/oss-security/2016/07/26/11Mailing ListX Refsource MLISTThird Party Advisory
git.gnome.org/browse/gdk-pixbuf/tree/NEWS?id=640134c46221689d263369872937192e4484c83bX Refsource CONFIRMRelease NotesVendor Advisory
www.ubuntu.com/usn/USN-3085-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.openwall.com/lists/oss-security/2016/07/13/11Mailing ListX Refsource MLISTExploitRelease NotesREPORT
git.gnome.org/browse/gdk-pixbuf/commit/?id=88af50a864195da1a4f7bda5f02539704fbda599X Refsource CONFIRMExploitVendor Advisory
lists.opensuse.org/opensuse-updates/2016-09/msg00040.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
bugzilla.gnome.org/show_bug.cgi?id=769170X Refsource CONFIRMExploitIssue TrackingThird Party AdvisoryVDB EntryREPORT
lists.debian.org/debian-lts-announce/2019/12/msg00025.htmlMailing ListX Refsource MLIST
advisories.mageia.org/MGASA-2016-0322.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=19070REPORT

Show all 17 references