Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A heap buffer overflow vulnerability was found in Eye of GNOME (eog) in the PNG metadata reader component (eog-metadata-reader-png). The flaw exists in the handling of cHRM and gAMA chunk resume state during PNG file parsing. An attacker could exploit this by crafting a malicious PNG file that, when opened by a victim, triggers the overflow, potentially leading to arbitrary code execution or a denial of service. Upstream issue: https://gitlab.gnome.org/GNOME/eog/-/issues/342
Vulnerability has been fixed upstream in the 50.4 release, which we already ship in f44, f45, and rawhide However, it appears that f43 is still vulnerable. We need to backport: - https://gitlab.gnome.org/GNOME/eog/-/commit/769e4309ae6976248d8c5debe0ff85ff167ed705 - https://gitlab.gnome.org/GNOME/eog/-/commit/04e4f313421eacb9fc529781542bb7fb81a3cd1a
FEDORA-2026-c84199fbcd (eog-49.3-2.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-c84199fbcd
FEDORA-2026-c84199fbcd has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-c84199fbcd` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-c84199fbcd See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-c84199fbcd (eog-49.3-2.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.