Bug 2251025 (CVE-2023-48161)
| Summary: | CVE-2023-48161 giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Avinash Hanwate <ahanwate> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ahughes, chazlett, kgrant, khosford, mbalaoal, mbalao, neugens, pjindal, sraghupu |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | GifLib 5.2.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A security flaw related to buffer overflow has been identified in GifLib. This flaw allows a nearby attacker to access sensitive information through the DumpSCreen2RGB function in gif2rgb.c.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2024-10-17 12:57:16 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2251137, 2251138, 2251139, 2251140, 2251141, 2251142, 2251143, 2251144, 2251145, 2251146 | ||
| Bug Blocks: | 2251026 | ||
|
Description
Avinash Hanwate
2023-11-22 12:13:17 UTC
Created giflib tracking bugs for this issue: Affects: fedora-all [bug 2251139] Created java-1.8.0-openjdk tracking bugs for this issue: Affects: fedora-all [bug 2251140] Created java-11-openjdk tracking bugs for this issue: Affects: fedora-all [bug 2251141] Created java-11-openjdk-portable tracking bugs for this issue: Affects: fedora-all [bug 2251142] Created java-17-openjdk tracking bugs for this issue: Affects: fedora-all [bug 2251143] Created java-17-openjdk-portable tracking bugs for this issue: Affects: fedora-all [bug 2251144] Created java-latest-openjdk tracking bugs for this issue: Affects: epel-all [bug 2251137] Affects: fedora-all [bug 2251145] Created java-latest-openjdk-portable tracking bugs for this issue: Affects: epel-all [bug 2251138] Affects: fedora-all [bug 2251146] This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2024:8120 https://access.redhat.com/errata/RHSA-2024:8120 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.8 Extended Update Support Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Red Hat Enterprise Linux 9.2 Extended Update Support Red Hat Enterprise Linux 9 Via RHSA-2024:8121 https://access.redhat.com/errata/RHSA-2024:8121 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Via RHSA-2024:8127 https://access.redhat.com/errata/RHSA-2024:8127 This issue has been addressed in the following products: Red Hat Build of OpenJDK 8u432 Via RHSA-2024:8118 https://access.redhat.com/errata/RHSA-2024:8118 This issue has been addressed in the following products: Red Hat Build of OpenJDK 11.0.25 Via RHSA-2024:8123 https://access.redhat.com/errata/RHSA-2024:8123 This issue has been addressed in the following products: Red Hat Build of OpenJDK 8u432 Via RHSA-2024:8119 https://access.redhat.com/errata/RHSA-2024:8119 This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.13 Via RHSA-2024:8125 https://access.redhat.com/errata/RHSA-2024:8125 This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.13 Via RHSA-2024:8126 https://access.redhat.com/errata/RHSA-2024:8126 This issue has been addressed in the following products: Red Hat Build of OpenJDK 21.0.5 Via RHSA-2024:8128 https://access.redhat.com/errata/RHSA-2024:8128 This issue has been addressed in the following products: Red Hat Build of OpenJDK 21.0.4 Via RHSA-2024:8129 https://access.redhat.com/errata/RHSA-2024:8129 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.8 Extended Update Support Red Hat Enterprise Linux 9.2 Extended Update Support Red Hat Enterprise Linux 9 Via RHSA-2024:8124 https://access.redhat.com/errata/RHSA-2024:8124 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.8 Extended Update Support Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Red Hat Enterprise Linux 9.2 Extended Update Support Red Hat Enterprise Linux 9 Via RHSA-2024:8117 https://access.redhat.com/errata/RHSA-2024:8117 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2024:8116 https://access.redhat.com/errata/RHSA-2024:8116 |