CVE-2018-10677: Buffer Overflow

Published May 2, 2018

Updated

The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 lacks certain checks against width and height, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file.

Affected Software

1 affected component

Miniupnp Project Ngiflib=0.4

Remediation

Patch Available

https://github.com/miniupnp/ngiflib/commit/b588a2249c7abbfc52173e32ee11d6facef82f89

Event History

May 2, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-10677?

CVE-2018-10677 has a medium severity level due to its potential to cause a denial of service and application crash.

How do I fix CVE-2018-10677?

To fix CVE-2018-10677, upgrade to a patched version of ngiflib that contains necessary checks and protections against malicious GIF files.

What vulnerability does CVE-2018-10677 exploit?

CVE-2018-10677 exploits a heap-based buffer overflow in the DecodeGifImg function, which can be triggered by specially crafted GIF files.

Which software is affected by CVE-2018-10677?

CVE-2018-10677 specifically affects MiniUPnP ngiflib version 0.4.

What impact can be caused by CVE-2018-10677?

CVE-2018-10677 can lead to denial of service through application crashes or potentially allow other unspecified impacts.