CVE-2019-17534

NameCVE-2019-17534
Descriptionvips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, leading to a use-after-free.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
vips (PTS)buster8.7.4-1+deb10u1fixed
bullseye8.10.5-2fixed
bookworm8.14.1-3+deb12u1fixed
trixie8.15.1-1fixed
sid8.15.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
vipssource(unstable)(not affected)

Notes

- vips <not-affected> (Vulnerable code never in a released version)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16796
Introduced by: https://github.com/libvips/libvips/commit/https://github.com/libvips/libvips/commit/25e457736173369dcb0f7c09d07af68aedbdc175
Fixed by: https://github.com/libvips/libvips/commit/ce684dd008532ea0bf9d4a1d89bacb35f4a83f4d

Search for package or bug name: Reporting problems