CVE-2017-16938: Buffer Overflow
Published Oct 17, 2017
·Updated
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
Affected Software
3 affected componentsFixes available
debian/optipng<=0.7.6-1, <=0.7.5-1
0.7.6-1.10.7.6-1+deb9u10.7.5-1+deb8u2
debian/optipng
0.7.7-10.7.7-20.7.7-3
Optipng Project Optipng=0.7.6
Remediation
Patch Available
Event History
Nov 24, 2017
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-16938?
CVE-2017-16938 has a high severity due to its potential to cause a denial-of-service attack.
2
How do I fix CVE-2017-16938?
To fix CVE-2017-16938, update OptiPNG to version 0.7.7 or later.
3
Which versions of OptiPNG are affected by CVE-2017-16938?
OptiPNG versions 0.7.6 and earlier are affected by CVE-2017-16938.
4
Can CVE-2017-16938 lead to remote code execution?
CVE-2017-16938 does not directly indicate remote code execution but allows for denial-of-service which could lead to further exploits.
5
Is CVE-2017-16938 applicable only to Debian systems?
While CVE-2017-16938 is documented in Debian, it can affect any system running the vulnerable versions of OptiPNG.