PT-2011-1650 · Gif2Apng · Gif2Apng

Patroklos Argyroudis · Publicado 2011-01-14 · Atualizado 2017-08-17 · CVE-2010-4695

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions gif2png versions 2.5.1 through 2.5.2

Description The issue allows remote attackers to create PNG files in unintended directories via a crafted command-line argument. This can be demonstrated by a CGI program that launches gif2png.

Recommendations For gif2png versions 2.5.1 and 2.5.2, consider restricting access to the command-line interface until a patch is available. As a temporary workaround, avoid using gif2png with untrusted input.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-4695

Produtos afetados

Gif2Apng

Referências · 12

• 🔥 http://cvs.fedoraproject.org/viewvc/rpms/gif2png/devel/gif2png-overflow.patch?root=extras&r1=1.1&r2=1.2 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=547515 · Exploit
• http://security.gentoo.org/glsa/glsa-201203-15.xml · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2010-4695 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-4695 · Aviso do Fabricante
• http://securityfocus.com/bid/45920 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051229.html · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550978 · Nota
• http://cvs.fedoraproject.org/viewvc/rpms/gif2png/devel/gif2png-overflow.patch?root=extras&view=log · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4695 · Nota de Segurança
• https://ubuntu.com/security/CVE-2010-4695 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64819 · Nota