Heap-based buffer overflow in GIFLIB - CVE-2016-3977

Vulnerability identifier: #VU20920

CSH Severity: High

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3977

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the gif2rgb() function (util/gif2rgb.c) in giflib 5.1.2. A remote attacker can use background color index in a GIF file to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

GIFLIB
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
giflib (Alpine package)
libgif7-debuginfo
giflib-debugsource
giflib-devel
libgif7
giflib-progs
giflib-progs-debuginfo
giflib-devel-32bit
libgif7-32bit
libgif7-32bit-debuginfo
EMC Cloud Tiering Appliance

Install update from vendor's website.

GIFLIB - update to 5.1.3
giflib (Alpine package) - update to 5.0.6-r1
libgif7-debuginfo - update to 5.2.1-150000.4.8.1
giflib-debugsource - update to 5.2.1-150000.4.8.1
giflib-devel - update to 5.2.1-150000.4.8.1
libgif7 - update to 5.2.1-150000.4.8.1
giflib-progs - update to 5.2.1-150000.4.8.1
giflib-progs-debuginfo - update to 5.2.1-150000.4.8.1
giflib-devel-32bit - update to 5.2.1-150000.4.8.1
libgif7-32bit - update to 5.2.1-150000.4.8.1
libgif7-32bit-debuginfo - update to 5.2.1-150000.4.8.1
EMC Cloud Tiering Appliance - update to 13.2.0.2.24

• http://bugs.fi/fuzzing/index.html
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00079.html
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00084.html
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00019.html
• http://www.securityfocus.com/bid/88103
• https://bugzilla.redhat.com/show_bug.cgi?id=1325771
• https://sourceforge.net/p/giflib/bugs/87/
• https://sourceforge.net/p/giflib/code/ci/ea8dbc5786862a3e16a5acfa3d24e2c2f608cd88/

• Heap-based buffer overflow in GIFLIB
• Heap-based buffer overflow in giflib (Alpine package)
• SUSE update for giflib
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• SUSE update for giflib