CVE-2018-11489 — giflib: heap-based buffer overflow in DGifDecompressLine function in dgif_lib.c

Back Back to CVE browser

HIGH

giflib: heap-based buffer overflow in DGifDecompressLine function in dgif_lib.c

Published May 26, 2018

8.8

HIGH

CVSS 3.1

EPSS 2.47%

Description

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain CrntCode array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

Affected products

Red Hat Enterprise Linux 5

giflib

Not affected
Red Hat Enterprise Linux 6

giflib

Not affected
Red Hat Enterprise Linux 7

giflib

Not affected
Red Hat Enterprise Linux 8

giflib

Not affected
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools

phantomjs

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	giflib	Not affected	n/a
Red Hat Enterprise Linux 6	giflib	Not affected	n/a
Red Hat Enterprise Linux 7	giflib	Not affected	n/a
Red Hat Enterprise Linux 8	giflib	Not affected	n/a
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools	phantomjs	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of giflib as shipped with Red Hat Enterprise Linux 5, 6, an 7.

Metrics

2.47% 0.02466

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.02466

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (20 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	2.47% (0.02466)	83.94th	v5 (v2026.06.15)
Jun 15, 2026	2.59% (0.02591)	83.22th	v5 (v2026.06.15)
Mar 30, 2025	0.82% (0.00821)	72.19th	v4 (v2025.03.14)
Mar 29, 2025	2.45% (0.02449)	75.29th	v4 (v2025.03.14)
Jul 20, 2024	0.93% (0.00928)	83.16th	v3 (v2023.03.01)
Jul 17, 2024	0.93% (0.00928)	83.16th	v3 (v2023.03.01)
Nov 8, 2023	0.93% (0.00928)	81.15th	v3 (v2023.03.01)
Oct 17, 2023	0.33% (0.00328)	67.56th	v3 (v2023.03.01)
Jul 8, 2023	0.32% (0.00320)	66.47th	v3 (v2023.03.01)
May 20, 2023	0.29% (0.00288)	64.21th	v3 (v2023.03.01)
May 8, 2023	0.24% (0.00242)	60.59th	v3 (v2023.03.01)
Mar 7, 2023	0.27% (0.00269)	62.59th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)
Feb 3, 2022	1.04% (0.01036)	27.56th	v1
Jan 6, 2022	1.04% (0.01036)	26.95th	v1
Sep 1, 2021	1.04% (0.01036)	62.47th	v1
Apr 14, 2021	1.04% (0.01036)	0.00th	v1

Weaknesses (3)

CWE-122

CWE-129

CWE-787

Out-of-bounds Write

References (7)

http://www.securityfocus.com/bid/104341
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2018-11489
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1583399
Issue Tracking
https://github.com/pts/sam2p/issues/37
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2018-11489
https://www.cve.org/CVERecord?id=CVE-2018-11489

Link	Providers	Tags
http://www.securityfocus.com/bid/104341		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2018-11489		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1583399		Issue Tracking
https://github.com/pts/sam2p/issues/37		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E		mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2018-11489
https://www.cve.org/CVERecord?id=CVE-2018-11489