An integer overflow flaw exists within the "gxps_images_create_from_png()" function in libgxps/gxps-images.c. An attacker can exploit this flaw to cause a heap-based buffer overflow by tricking a user into opening a specially crafted XPS document in an application using libgxps.
Actually, it seesm like RHEL7 is not affected. We have a patch (libgxps-0.2.4-GXPSImage.patch), which appears to always cause a crash shortly before reaching the vulnerable code path.
Upstream patch: https://github.com/GNOME/libgxps/commit/123dd99c6a1ae2ef6fcb5547e51fa58e8c954b51 Something that may be worth backporting: https://github.com/GNOME/libgxps/commit/672c65ea8cbd2bcfd82a6b6498a4f1eb9daf5ec5
Acknowledgments: Name: Stefan Cornelius (Red Hat)
Created libgxps tracking bugs for this issue: Affects: fedora-all [bug 1591132]