gif2png: Multiple vulnerabilities
1.
Gentoo Linux Security Advisory
Version Information
| Advisory Reference |
GLSA 201203-15 / gif2png |
| Release Date |
March 16, 2012 |
| Latest Revision |
March 16, 2012: 1 |
| Impact |
normal |
| Exploitable |
remote |
| Package |
Vulnerable versions |
Unaffected versions |
Architecture(s) |
| media-gfx/gif2png |
<
2.5.8 |
>=
2.5.8 |
All supported architectures
|
Related bugreports:
#351698
Synopsis
Multiple vulnerabilities have been found in gif2png, the worst of
which might allow execution of arbitrary code.
2.
Impact Information
Background
gif2png converts images from GIF format to PNG format.
Description
Two vulnerabilities have been found in gif2png:
- A boundary error in gif2png.c could cause a buffer overflow
(CVE-2010-4694).
- The patch for CVE-2009-5018 causes gif2png to truncate GIF pathnames
(CVE-2010-4695).
Impact
A remote attacker could entice a user to open a specially crafted GIF
file, possibly resulting in execution of arbitrary code, a Denial of
Service condition, or the creation of PNG files in unintended
directories.
3.
Resolution Information
Workaround
There is no known workaround at this time.
Resolution
All gif2png users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/gif2png-2.5.8"
|
4.
References
|
