Bug 1639548 (CVE-2018-16981) - CVE-2018-16981 stbi: Heap-based buffer overflow in stb_image.h:stbi__out_gif_code() function
Summary: CVE-2018-16981 stbi: Heap-based buffer overflow in stb_image.h:stbi__out_gif_...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2018-16981
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1639549 1639550 1639551 1639552 1639553 1639554
Blocks: 1639556
TreeView+ depends on / blocked
 
Reported: 2018-10-16 04:58 UTC by Sam Fowler
Modified: 2021-02-16 22:56 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2018-11-16 13:49:22 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-10-16 04:58:32 UTC 
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.


Upstream Issue:

https://github.com/nothings/stb/issues/656
Comment 1 Sam Fowler 2018-10-16 04:59:19 UTC 
Created SFML tracking bugs for this issue:

Affects: fedora-all [bug 1639552]


Created catimg tracking bugs for this issue:

Affects: fedora-all [bug 1639550]


Created cogl tracking bugs for this issue:

Affects: fedora-all [bug 1639551]


Created stbi tracking bugs for this issue:

Affects: fedora-all [bug 1639549]
Comment 3 Stefan Cornelius 2018-11-16 13:49:22 UTC 
the stbi versions bundled with clutter and cogl don't support gif loading.
Comment 4 Stefan Cornelius 2018-11-16 13:49:33 UTC 
Statement:

This issue did not affect the versions of cogl and compat-cogl114 as shipped with Red Hat Enterprise Linux 7.

This issue did not affect the versions of clutter as shipped with Red Hat Enterprise Linux 6.
Note You need to log in before you can comment on or make changes to this bug.