CVE-2011-2896

David Koblas' GIF decoder LZW decoder buffer overflow

Severity Score

5.1

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

El descompresor LZW en (1) la función LWZReadByte en giftoppm.c en el David Koblas GIF decoder en PBMPLUS, tal y como se utiliza en la función gif_read_lzw en filter/image-gif.c en CUPS antes de la versión v1.4.7, (2) la función LZWReadByte en plug-ins/common/file-gif-load.c en GIMP v2.6.11 y anteriores, (3) la función LZWReadByte en img/gifread.c en XPCE en SWI-Prolog v5.10.4 y anteriores, y (4) otros productos, no controla correctamente las palabras de código que están ausentes de la tabla de descompresión, lo que permite provocar a atacantes remotos un bucle infinito o un desbordamiento de búfer basado en memoria dinámica (heap), y posiblemente, ejecutar código de su elección, a través de un flujo o fichero comprimido debidamente modificado. Se trata de un problema relacionado con los CVE-2006-1168 y CVE-2011 2895.

*Credits: N/A

CVSS Scores

NISTv2 5.1

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-07-27 CVE Reserved
2011-08-19 CVE Published
2024-08-06 CVE Updated
2024-10-19 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-787: Out-of-bounds Write

CAPEC

References (33)

URL	Tag	Source
http://secunia.com/advisories/45621	Broken Link
http://secunia.com/advisories/45900	Broken Link
http://secunia.com/advisories/45945	Broken Link
http://secunia.com/advisories/45948	Broken Link
http://secunia.com/advisories/46024	Broken Link
http://secunia.com/advisories/48236	Broken Link
http://secunia.com/advisories/48308	Broken Link
http://secunia.com/advisories/50737	Broken Link
http://www.securityfocus.com/bid/49148	Broken Link
http://www.securitytracker.com/id?1025929	Broken Link
http://www.swi-prolog.org/bugzilla/show_bug.cgi?id=7#c4	Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=730338	Issue Tracking

URL	Date	SRC

URL	Date	SRC
http://cups.org/str.php?L3867	2022-02-07
http://git.gnome.org/browse/gimp/commit/?id=376ad788c1a1c31d40f18494889c383f6909ebfc	2022-02-07
http://www.openwall.com/lists/oss-security/2011/08/10/10	2022-02-07
https://bugzilla.redhat.com/show_bug.cgi?id=727800	2012-08-20

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/064600.html	2022-02-07
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/064873.html	2022-02-07
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065527.html	2022-02-07
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065539.html	2022-02-07
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065550.html	2022-02-07
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065651.html	2022-02-07
http://rhn.redhat.com/errata/RHSA-2012-1180.html	2022-02-07
http://rhn.redhat.com/errata/RHSA-2012-1181.html	2022-02-07
http://security.gentoo.org/glsa/glsa-201209-23.xml	2022-02-07
http://www.debian.org/security/2011/dsa-2354	2022-02-07
http://www.debian.org/security/2012/dsa-2426	2022-02-07
http://www.mandriva.com/security/advisories?name=MDVSA-2011:146	2022-02-07
http://www.mandriva.com/security/advisories?name=MDVSA-2011:167	2022-02-07
http://www.redhat.com/support/errata/RHSA-2011-1635.html	2022-02-07
http://www.ubuntu.com/usn/USN-1207-1	2022-02-07
http://www.ubuntu.com/usn/USN-1214-1	2022-02-07
https://access.redhat.com/security/cve/CVE-2011-2896	2012-08-20

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Swi-prolog Search vendor "Swi-prolog"		Swi-prolog Search vendor "Swi-prolog" for product "Swi-prolog"				<= 5.10.4 Search vendor "Swi-prolog" for product "Swi-prolog" and version " <= 5.10.4"		-		Affected
Apple Search vendor "Apple"		Cups Search vendor "Apple" for product "Cups"				<= 1.4.6 Search vendor "Apple" for product "Cups" and version " <= 1.4.6"		-		Affected
Gimp Search vendor "Gimp"		Gimp Search vendor "Gimp" for product "Gimp"				<= 2.6.11 Search vendor "Gimp" for product "Gimp" and version " <= 2.6.11"		-		Affected