Executive brief
A vulnerability exists in GIFLIB, a widely used library for processing GIF images. The flaw occurs in the 'gifcolor' utility, where improper memory management can lead to application crashes or potentially allow an attacker to execute unauthorized code. This could impact systems that use this utility to process untrusted image files, potentially leading to data breaches or service disruptions.
Technical details
Multiple use-after-free and double-free vulnerabilities exist in gifcolor.c within GIFLIB 5.1.2. The root cause is consecutive calls to EGifCloseFile (lines 122 and 124) using the same GifFile parameter. This results in redundant calls to free() for the GifFile object and its internal Private data structures. Because the first call deallocates the memory, the second call attempts to access and free it again, leading to memory corruption. An attacker could potentially exploit this via a specially crafted GIF file processed by the gifcolor utility to achieve remote code execution or a denial of service. The issue was resolved in GIFLIB version 5.1.3 by removing the redundant function call.
Affected products
- GIFLIB project GIFLIB 5.1.2
Timeline
- 2016-02-18: disclosed: Issue reported on SourceForge bug tracker
- 2016-03-15: patched: Fixed in source by Eric S. Raymond
- 2016-03-16: advisory: CVE assigned via Openwall oss-security mailing list
- 2017-01-23: other: NVD publication date