Vulnerability CVE-2023-44821: Information
Description
Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.
Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| gifsicle | sisyphus | 1.95-alt1 | 1.95-alt2 | ALT-PU-2024-6946-1 | 345590 | Fixed |
| gifsicle | sisyphus_e2k | 1.95-alt2 | 1.95-alt2 | ALT-PU-2024-7008-1 | - | Fixed |
| gifsicle | sisyphus_riscv64 | 1.95-alt2 | 1.95-alt2 | ALT-PU-2024-7000-1 | - | Fixed |
| gifsicle | sisyphus_loongarch64 | 1.95-alt2 | 1.95-alt2 | ALT-PU-2024-7042-1 | - | Fixed |
| gifsicle | p10 | 1.95-alt2 | 1.95-alt2 | ALT-PU-2024-6948-2 | 345592 | Fixed |
| gifsicle | p10_e2k | 1.95-alt2 | 1.95-alt2 | ALT-PU-2024-7157-1 | - | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://github.com/kohler/gifsicle/issues/195 |
|
| https://github.com/kohler/gifsicle/issues/65 |
|
| FEDORA-2024-5e50570506 | |
| FEDORA-2024-4672c1ff2d |