CVE-2018-11490

NameCVE-2018-11490
DescriptionThe DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3223-1
Debian Bugs904114

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
giflib (PTS)buster5.1.4-3vulnerable
buster (security)5.1.4-3+deb10u1fixed
bullseye5.1.9-2fixed
trixie, sid, bookworm5.2.1-2.5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
giflibsourceexperimental5.1.7-1
giflibsourcebuster5.1.4-3+deb10u1DLA-3223-1
giflibsource(unstable)5.1.9-1904114

Notes

https://github.com/pts/sam2p/issues/38
https://sourceforge.net/p/giflib/bugs/113/
https://sourceforge.net/p/giflib/code/ci/08438a5098f3bb1de23a29334af55eba663f75bd/
Issue was reported against sam2p but issue is in dgif_lib.c from giflib.

Search for package or bug name: Reporting problems