CVE-2008-1373: Buffer Overflow
Buffer overflow in the gifreadlzw function in CUPS 1.3.6 allows remote attackers to have an unknown impact via a GIF file with a large codesize value, a similar issue to CVE-2006-4484.
Other sources
It was discovered that GIF parsing code used by CUPS printing system is affected by similar issue as GIF parsers used by gd / netpbm / tk / SDLimage.
Value of codesize read from GIF image is not properly validate before being used to initialize table array in gifreadlzw(), causing a static buffer overflow.
Issue is similar to: CVE-2006-4484 (gd), CVE-2007-6697 (SDLimage), CVE-2008-0553 (tk), CVE-2008-0554 (netpbm)
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2008-1373?
CVE-2008-1373 has a high severity due to the potential for remote code execution caused by a buffer overflow in the CUPS GIF parsing code.
How do I fix CVE-2008-1373?
To fix CVE-2008-1373, update CUPS to version 1.1.22-0.rc1.9.20.2.el4_6.6 or 1.2.4-11.14.el5_1.6, or ensure that you are using a version later than 1.3.6.
What systems are affected by CVE-2008-1373?
CVE-2008-1373 affects CUPS version 1.3.6 and earlier versions on systems such as Red Hat Enterprise Linux.
Can CVE-2008-1373 be exploited remotely?
Yes, CVE-2008-1373 can be exploited remotely by sending a specially crafted GIF file to the CUPS service.
What code function is associated with CVE-2008-1373?
CVE-2008-1373 is associated with the gif_read_lzw function in the GIF parsing code used by the CUPS printing system.