Division by zero in GIFLIB - CVE-2019-15133

Vulnerability identifier: #VU30817

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15133

CWE-ID: CWE-369

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data structure is equal to zero.

GIFLIB
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
openSUSE Leap
libgif7-debuginfo
giflib-debugsource
giflib-devel
libgif7
giflib-progs
giflib-progs-debuginfo
giflib-devel-32bit
libgif7-32bit
libgif7-32bit-debuginfo
EMC Cloud Tiering Appliance

Install update from vendor's website.

GIFLIB - update to 5.1.7
libgif7-debuginfo - update to 5.2.1-150000.4.8.1
giflib-debugsource - update to 5.2.1-150000.4.8.1
giflib-devel - update to 5.2.1-150000.4.8.1
libgif7 - update to 5.2.1-150000.4.8.1
giflib-progs - update to 5.2.1-150000.4.8.1
giflib-progs-debuginfo - update to 5.2.1-150000.4.8.1
giflib-devel-32bit - update to 5.2.1-150000.4.8.1
libgif7-32bit - update to 5.2.1-150000.4.8.1
libgif7-32bit-debuginfo - update to 5.2.1-150000.4.8.1
EMC Cloud Tiering Appliance - update to 13.2.0.2.24

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13008
• https://usn.ubuntu.com/4107-1/

• Division by zero in GIFLIB
• SUSE update for giflib
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• SUSE update for giflib