GTK+ Insecure Library Loading Vulnerability

A vulnerability has been identified in GTK+, which can be exploited by malicious people to compromise an application using the library.

 

The vulnerability is caused due to the "_gdk_input_wintab_init_check()" (gdk/win32/gdkinput-win32.c) and the "xp_theme_init()" functions (modules/engines/ms-windows/xp_theme.c) loading libraries (wintab32.dll and uxtheme.dll) in an insecure manner. This can be exploited to load arbitrary libraries when an application using this library e.g. opens a file located on a remote WebDAV or SMB share.