CVE-2022-28506

Name
CVE-2022-28506
Description
There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB() in gif2rgb.c:298:45.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://sourceforge.net/p/giflib/bugs/159/
MISC https://github.com/verf1sh/Poc/blob/master/asan_report_giflib.png
MISC https://github.com/verf1sh/Poc/blob/master/giflib_poc
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4CJSHXBD2RS5OJNWSHQZVMTQCCTIPYS/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEAFUZXOOJJVFYRQM6IIJ7LMLEKCCESG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4CJSHXBD2RS5OJNWSHQZVMTQCCTIPYS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEAFUZXOOJJVFYRQM6IIJ7LMLEKCCESG/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:giflib_project:giflib:5.2.1:*:*:*:*:*:*:* giflib == None == 5.2.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
giflib 3.15-main 5.2.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.14-main 5.2.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.13-main 5.2.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.12-main 5.2.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
giflib 3.16-main 5.2.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable