CVE-2024-45993 - OpenCVE

Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Giflib Project	Giflib

No data.

No data.

References

Link	Providers
http://giflib.com
https://gitlab.com/mthandazo/project-pov
https://nvd.nist.gov/vuln/detail/CVE-2024-45993
https://www.cve.org/CVERecord?id=CVE-2024-45993

History

Tue, 01 Oct 2024 01:15:00 +0000

Type	Values Removed	Values Added
Title		giflib: heap buffer overflow via gif2rgb
References		https://nvd.nist.gov/vuln/detail/CVE-2024-45993 https://www.cve.org/CVERecord?id=CVE-2024-45993
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 30 Sep 2024 19:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Giflib Project Giflib Project giflib
Weaknesses		CWE-122
CPEs		cpe:2.3:a:giflib_project:giflib::::::::
Vendors & Products		Giflib Project Giflib Project giflib
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 30 Sep 2024 17:00:00 +0000

Type	Values Removed	Values Added
Description		Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.
References		http://giflib.com https://gitlab.com/mthandazo/project-pov

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-09-30T00:00:00

Updated: 2024-09-30T18:41:36.515Z

Reserved: 2024-09-11T00:00:00

Link: CVE-2024-45993

Vulnrichment

Updated: 2024-09-30T18:38:40.200Z

NVD

Status : Awaiting Analysis

Published: 2024-09-30T17:15:04.473

Modified: 2024-10-04T13:51:25.567

Link: CVE-2024-45993

Redhat

Severity : Moderate

Publid Date: 2024-09-30T17:15:04Z

Links: CVE-2024-45993 - Bugzilla

{"bugzilla": {"description": "giflib: heap buffer overflow via gif2rgb", "id": "2315710", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315710"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-122", "details": ["Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.", "A flaw was found in the GIFLIB project. Processing specially-crafted input may trigger a heap buffer overflow condition, which can cause a denial of service."], "name": "CVE-2024-45993", "package_state": [{"cpe": "cpe:/a:redhat:openjdk:11", "fix_state": "Not affected", "package_name": "java-11-openjdk-portable", "product_name": "Red Hat build of OpenJDK 11"}, {"cpe": "cpe:/a:redhat:openjdk:17", "fix_state": "Not affected", "package_name": "java-17-openjdk-portable", "product_name": "Red Hat build of OpenJDK 17"}, {"cpe": "cpe:/a:redhat:openjdk:1.8", "fix_state": "Not affected", "package_name": "java-1.8.0-openjdk-portable", "product_name": "Red Hat build of OpenJDK 1.8"}, {"cpe": "cpe:/a:redhat:openjdk:21", "fix_state": "Not affected", "package_name": "java-21-openjdk-portable-rhel7", "product_name": "Red Hat build of OpenJDK 21"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "giflib", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "giflib", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "java-11-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "giflib", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "java-11-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-09-30T17:15:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-45993\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-45993\nhttp://giflib.com\nhttps://gitlab.com/mthandazo/project-pov"], "statement": "No Red Hat products are affected by this vulnerability.", "threat_severity": "Moderate"}