PT-2016-3811 · Giflib+1 · Giflib+1

Hans Jerry Illikainen · Published 2016-01-15 · Updated 2024-06-15 · CVE-2015-7555

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions giflib version 5.1.1

Description The issue is related to a heap-based buffer overflow in the giffix.c file of giflib, which can be triggered by attackers using crafted image and logical screen width fields in a GIF file, leading to a denial of service (program crash).

Recommendations For giflib version 5.1.1, update to a newer version that contains a fix for this issue.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-7555

DLA-389-1

MGASA-2016-0020

OPENSUSE-SU-2016_0207-1

OPENSUSE-SU-2024:10016-1

SUSE-SU-2016:0192-1

SUSE-SU-2016:0202-1

SUSE-SU-2016_0192-1

SUSE-SU-2016_0202-1

Affected Products

Suse

Giflib

References · 33

• 🔥 http://packetstormsecurity.com/files/135034/giflib-5.1.1-Heap-Overflow.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Dec/83 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7555 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0020 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-7555 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7555 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174876.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10016-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-7555 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:0192-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-7555 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7555 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2016-January/174870.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-7555 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0020.html · Security Note