CVE-2018-11490 - giflib: heap-based buffer overflow in DGifDecompressLine function in dgif_lib.c

Back Back to CVE browser

HIGH

giflib: heap-based buffer overflow in DGifDecompressLine function in dgif_lib.c

Published May 26, 2018

8.8

HIGH

CVSS 3.1

EPSS 2.45%

Description

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

Affected products

Red Hat Enterprise Linux 5

giflib

Not affected
Red Hat Enterprise Linux 6

giflib

Not affected
Red Hat Enterprise Linux 7

giflib

Not affected
Red Hat Enterprise Linux 8

giflib

Not affected
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools

phantomjs

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	giflib	Not affected	n/a
Red Hat Enterprise Linux 6	giflib	Not affected	n/a
Red Hat Enterprise Linux 7	giflib	Not affected	n/a
Red Hat Enterprise Linux 8	giflib	Not affected	n/a
Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools	phantomjs	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the versions of giflib as shipped with Red Hat Enterprise Linux 5, 6, an 7.

Weaknesses (3)

CWE-122

CWE-129

CWE-787

Out-of-bounds Write

References (8)

http://www.securityfocus.com/bid/104327
vdb-entryThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2018-11490
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1583400
Issue Tracking
https://github.com/pts/sam2p/issues/38
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00008.html
mailing-listMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-11490
https://usn.ubuntu.com/4107-1/
vendor-advisoryThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-11490

Link	Providers	Tags
http://www.securityfocus.com/bid/104327		vdb-entryThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2018-11490		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1583400		Issue Tracking
https://github.com/pts/sam2p/issues/38		Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00008.html		mailing-listMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-11490
https://usn.ubuntu.com/4107-1/		vendor-advisoryThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-11490