Описание
Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.
This issue affects giflib: through 5.2.2.
A flaw was found in the gif2rgb utility of giflib. This vulnerability allows an attacker to cause a heap-based buffer overflow via crafted GIF files. The issue arises due to improper handling of certain GIF image data, leading to memory corruption.
Отчет
Within regulated environments, a combination of the following controls acts as a significant barrier to the successful exploitation of a CWE-122: Heap-based Buffer Overflow vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low. Access to the platform is granted only after successful hard token, multi-factor authentication (MFA), which is coupled with least privilege principles to ensure that only authorized roles and users can execute or manipulate code. Red Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. This minimizes the number of components that could be affected by heap-based buffer overflow exploitations. The environment leverages malicious code protections such as IPS/IDS and antimalware solutions that detect and respond to indicators in real time, preventing or limiting the impact of exploitation attempts. Static code analysis and peer code review techniques ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks. Finally, memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) enhance resilience against memory buffer overflows and denial-of-service attacks.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of OpenJDK 11 | java-11-openjdk-portable | Fix deferred | ||
| Red Hat build of OpenJDK 17 | java-17-openjdk-portable | Fix deferred | ||
| Red Hat build of OpenJDK 1.8 | java-1.8.0-openjdk-portable | Fix deferred | ||
| Red Hat build of OpenJDK 21 | java-21-openjdk-portable-rhel7 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | giflib | Fix deferred | ||
| Red Hat Enterprise Linux 10 | java-21-openjdk | Fix deferred | ||
| Red Hat Enterprise Linux 6 | giflib | Fix deferred | ||
| Red Hat Enterprise Linux 7 | giflib | Fix deferred | ||
| Red Hat Enterprise Linux 7 | java-1.8.0-openjdk | Fix deferred | ||
| Red Hat Enterprise Linux 8 | giflib | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2.
Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2.
Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. ...
EPSS
5.9 Medium
CVSS3