PT-2011-1650 · Gif2Apng · Gif2Apng

Patroklos Argyroudis · Published 2011-01-14 · Updated 2017-08-17 · CVE-2010-4695

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions gif2png versions 2.5.1 through 2.5.2

Description The issue allows remote attackers to create PNG files in unintended directories via a crafted command-line argument. This can be demonstrated by a CGI program that launches gif2png.

Recommendations For gif2png versions 2.5.1 and 2.5.2, consider restricting access to the command-line interface until a patch is available. As a temporary workaround, avoid using gif2png with untrusted input.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-4695

Affected Products

Gif2Apng

References · 12

• 🔥 http://cvs.fedoraproject.org/viewvc/rpms/gif2png/devel/gif2png-overflow.patch?root=extras&r1=1.1&r2=1.2 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=547515 · Exploit
• http://security.gentoo.org/glsa/glsa-201203-15.xml · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2010-4695 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-4695 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051229.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4695 · Security Note
• https://ubuntu.com/security/CVE-2010-4695 · Vendor Advisory
• http://securityfocus.com/bid/45920 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550978 · Note
• http://cvs.fedoraproject.org/viewvc/rpms/gif2png/devel/gif2png-overflow.patch?root=extras&view=log · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64819 · Note