CVE-2016-6855

What it actually does

Invalid UTF-8 input to GMarkup triggers an out-of-bounds write in Eye of GNOME when paired with glib versions before 2.44.1, resulting in a crash.

Why it matters to the business

Users of older Linux distributions may experience sudden application crashes when opening image files that contain malformed metadata, interrupting normal workflows and requiring restarts or alternative viewers.

How an attack unfolds

An attacker crafts an image file containing invalid UTF-8 sequences in metadata, then delivers the file to a target user who opens it with the vulnerable Eye of GNOME viewer; the malformed data reaches GMarkup and triggers the out-of-bounds write that crashes the process.

How to fix it

Upgrade Eye of GNOME to version 3.18.3 or later and 3.20.4 or later, and ensure glib is at least 2.44.1; apply all available distribution security updates for fedoraproject fedora, opensuse leap, opensuse opensuse, canonical ubuntu linux, and gnome packages.

How to confirm the fix worked

Verify installed eog and glib package versions against the fixed releases; attempt to open a test file containing invalid UTF-8 metadata and confirm the application no longer crashes; review distribution changelogs for the CVE fix.

Typical attack path

1. Attacker generates a malicious image file embedding invalid UTF-8 in metadata fields
2. File is distributed via email, web download, or shared storage
3. Victim opens the file using Eye of GNOME on an affected system with glib < 2.44.1
4. GMarkup processing encounters the malformed UTF-8 and performs an out-of-bounds write
5. Application crashes, achieving denial of service

How to detect it

Review application crash logs and core dumps for segmentation faults originating from eog or glib GMarkup processing; search system logs for repeated eog process terminations when opening image files.

What your security team should do

• Prioritize patching eog and glib on all affected endpoints within 30 days given the available public exploit
• Block or sanitize image files from untrusted sources in high-risk environments until patches are deployed
• Monitor vulnerability scanners for remaining instances of eog < 3.18.3 or glib < 2.44.1