CVE-2023-44821

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-44821
Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/kohler/gifsicle/issues/195 Exploit Issue Tracking Vendor Advisory
https://github.com/kohler/gifsicle/issues/65 Exploit Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5/
Configurations

Configuration 1 (hide)

cpe:2.3:a:lcdf:gifsicle:*:*:*:*:*:*:*:*
History

01 Mar 2024, 06:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5/ -

07 Nov 2023, 04:21

Type Values Removed Values Added
Summary ** DISPUTED ** Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line. Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.

24 Oct 2023, 16:06

Type Values Removed Values Added
CPE cpe:2.3:a:gifsicle_project:gifsicle:*:*:*:*:*:*:*:* cpe:2.3:a:lcdf:gifsicle:*:*:*:*:*:*:*:*
First Time Lcdf gifsicle
Lcdf

24 Oct 2023, 14:10

Type Values Removed Values Added
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Gifsicle Project
Gifsicle Project gifsicle
References (MISC) https://github.com/kohler/gifsicle/issues/65 - (MISC) https://github.com/kohler/gifsicle/issues/65 - Exploit, Issue Tracking
References (MISC) https://github.com/kohler/gifsicle/issues/195 - (MISC) https://github.com/kohler/gifsicle/issues/195 - Exploit, Issue Tracking, Vendor Advisory
CPE cpe:2.3:a:gifsicle_project:gifsicle:*:*:*:*:*:*:*:*

10 Oct 2023, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-09 20:15

Updated : 2024-08-02 20:16

NVD link : CVE-2023-44821

Mitre link : CVE-2023-44821

JSON object : View

Products Affected

lcdf

  • gifsicle
CWE
CWE-401

Missing Release of Memory after Effective Lifetime