Bug 171417 - CVE-2005-2974 Several libungif issues (CVE-2005-3350)
Summary: CVE-2005-2974 Several libungif issues (CVE-2005-3350)
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: libungif
Version: 4
Hardware: All
OS: Linux
medium
high
Target Milestone: ---
Assignee: Matthias Clasen
QA Contact:
URL:
Whiteboard: impact=important,source=vendorsec,pub...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-10-21 16:16 UTC by Josh Bressers
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version: libungif-4.1.3-3.fc4.2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-11-08 13:39:48 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Josh Bressers 2005-10-21 16:16:38 UTC 
+++ This bug was initially created as a clone of Bug #171413 +++

Chris Evans reported several issues with libungif to vendor-sec.  They have been
fixed in libungif-4.1.4, but not noted as security issues.

"I believe that the recently released libungif-4.1.4 fixes these
crashes. Credit here must go to Daniel Eisenbud who independently
noticed libungif crashes _and_ patched it to fix it."
Comment 1 Josh Bressers 2005-10-21 16:17:27 UTC 
This issue should also affect FC3
Comment 2 Josh Bressers 2005-10-27 23:14:21 UTC 
bad1.gif triggers a NULL dereference crash
CVE-2005-2974 libungif NULL pointer deref

bad2 and bad3 trigger out of bounds memory access crashes.  bad2 may
possibly allow for arbitrary code execution as it's an OOB write.
CVE-2005-3350 libungif OOB access
Comment 3 Josh Bressers 2005-11-03 15:46:36 UTC 
Lifting embargo
Comment 4 Fedora Update System 2005-11-03 17:15:57 UTC 
From User-Agent: XML-RPC

libungif-4.1.3-1.fc3.2 has been pushed for FC3, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.
Comment 5 Fedora Update System 2005-11-03 17:16:10 UTC 
From User-Agent: XML-RPC

libungif-4.1.3-3.fc4.2 has been pushed for FC4, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.