CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46009
https://notcve.org/view.php?id=CVE-2023-46009
gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c. Se descubrió que gifsicle-1.94 tenía una vulnerabilidad de Floating Point Exception (FPE) a través de resize_stream en src/xform.c. • https://github.com/kohler/gifsicle/issues/196 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF • CWE-697: Incorrect Comparison •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 2CVE-2023-44821
https://notcve.org/view.php?id=CVE-2023-44821
Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line. ** EN DISPUTA ** Gifsicle hasta 1.94, si se implementa de una manera que permita que entradas no confiables afecten las llamadas de Gif_Realloc, podría permitir una denegación de servicio (consumo de memoria). NOTA: esto ha sido cuestionado por varias partes porque el código Gifsicle no se usa comúnmente para operaciones desatendidas en las que llegan nuevas entradas para un proceso de larga duración, no incluye funcionalidad para vincularlo a otra aplicación como una librería y no tener casos de uso realistas en los que un adversario controla toda la línea de comando. • https://github.com/kohler/gifsicle/issues/195 https://github.com/kohler/gifsicle/issues/65 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-36193
https://notcve.org/view.php?id=CVE-2023-36193
Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c. • https://github.com/kohler/gifsicle/issues/191 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-19752
https://notcve.org/view.php?id=CVE-2020-19752
The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference. La función find_color_or_error en gifsicle versión 1.92, contiene una desreferencia de puntero NULL • https://github.com/kohler/gifsicle/issues/140 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7H3ASG2BD4D4SAUUI6TOLUZYP2QYYHXY https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DH7X7PGUN5BYXKW533DAX4KAEM4HPMJC • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18120
https://notcve.org/view.php?id=CVE-2017-18120
A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or unspecified other impact via a maliciously crafted file, because last_name is mishandled, a different vulnerability than CVE-2017-1000421. Un error de doble liberación (double free) en la función read_gif en gifread.c en gifsicle 1.90 permite que un atacante remoto provoque un ataque de denegación de servicio (DoS) u otro tipo de impacto sin especificar mediante un archivo maliciosamente manipulado. Esta vulnerabilidad es diferente de CVE-2017-1000421. • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878739 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881120 https://github.com/kohler/gifsicle/commit/118a46090c50829dc543179019e6140e1235f909 https://github.com/kohler/gifsicle/issues/117 • CWE-415: Double Free •