SUSE-SU-2024:0786-1: Security update for giflib
This update for giflib fixes the following issues: Update to version 5.2.2 Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
138 Documentation for obsolete utilities still installed
139: Typo in "LZW image data" page ("1102 = 410")
140: Typo in "LZW image data" page ("LWZ")
141: Typo in "Bits and bytes" page ("filed")
Note as already fixed SF issue #143: cannot compile under mingw
144: giflib-5.2.1 cannot be build on windows and other platforms using c89
145: Remove manual pages installation for binaries that are not installed too
146: [PATCH] Limit installed man pages to binaries, move giflib to section 7
147 [PATCH] Fixes to doc/whatsinagif/ content
148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB
Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1 Declared Won't-fix on SF issue 149: Out of source builds no longer possible
151: A heap-buffer-overflow in gif2rgb.c:294:45
152: Fix some typos on the html documentation and man pages
153: Fix segmentation faults due to non correct checking for args
154: Recover the giffilter manual page
155: Add gifsponge docs
157: An OutofMemory-Exception or Memory Leak in gif2rgb
158: There is a null pointer problem in gif2rgb
159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45
163: detected memory leaks in openbsdreallocarray giflib/openbsd-reallocarray.c
164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c
166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c
167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libgif7to a version that resolves this vulnerability.Fixed in 5.2.2-150000.4.13.1 - Upgrade
Upgrade
suse/giflib-progsto a version that resolves this vulnerability.Fixed in 5.2.2-150000.4.13.1 - Upgrade
Upgrade
suse/giflib-progs-debuginfoto a version that resolves this vulnerability.Fixed in 5.2.2-150000.4.13.1 - Upgrade
Upgrade
suse/giflib-debugsourceto a version that resolves this vulnerability.Fixed in 5.2.2-150000.4.13.1 - Upgrade
Upgrade
suse/libgif7-debuginfoto a version that resolves this vulnerability.Fixed in 5.2.2-150000.4.13.1 - Upgrade
Upgrade
suse/giflib-develto a version that resolves this vulnerability.Fixed in 5.2.2-150000.4.13.1 - Upgrade
Upgrade
suse/giflib-develto a version that resolves this vulnerability.Fixed in 32bit-5.2.2-150000.4.13.1 - Upgrade
Upgrade
suse/libgif7to a version that resolves this vulnerability.Fixed in 32bit-debuginfo-5.2.2-150000.4.13.1 - Upgrade
Upgrade
suse/libgif7to a version that resolves this vulnerability.Fixed in 32bit-5.2.2-150000.4.13.1 - Upgrade
Upgrade
giflibto a version that resolves this vulnerability.Fixed in 5.2.2
Event History
Child vulnerabilities
Contains the following vulnerabilities.