CVE-2017-20286: DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette
DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in ilgif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.
Affected Software
Event History
Frequently Asked Questions
What conditions must a GIF meet to trigger the issue?
The GIF must be crafted with two frames. Its second frame must use disposal method 1 and include a local colour table.
How much memory can be overwritten, and is exploitation potentially severe?
The overflow can write up to 384 attacker-controlled bytes beyond the 768-byte palette heap allocation. The issue may allow code execution and affects confidentiality, integrity, and availability.
How can I determine whether a deployment is affected?
Check whether the application uses DevIL version 1.8.0 or earlier and loads GIF images. The vulnerable code path is the GIF palette handling in iGetPalette() in il_gif.cpp.