CVE-2017-18120 (High) detected in gifsicle-v1.90

[mend-bolt-for-github]

CVE-2017-18120 - High Severity Vulnerability

Vulnerable Library - gifsiclev1.90

Create, manipulate, and optimize GIF images and animations

Library home page: https://github.com/kohler/gifsicle.git

Found in HEAD commit: bb38138afd18608fdd479021f598d41d60a143e6

Library Source Files (24)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/opttemplate.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/ungifwrt.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/giffunc.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/merge.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/win32cfg.h
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/kcolor.h
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/gifread.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/gifdiff.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/gifunopt.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/support.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/include/lcdfgif/gifx.h
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/include/lcdf/inttypes.h
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/gifx.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/clp.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/gifsicle.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/gifview.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/gifsicle.h
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/gifwrite.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/xform.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/quantize.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/giftoc.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/src/optimize.c
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/include/lcdf/clp.h
• _depth_0/docs/website/node_modules/gifsicle/vendor/source/gifsicle.tar/gifsicle-1.90/include/lcdfgif/gif.h

Vulnerability Details

A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or unspecified other impact via a maliciously crafted file, because last_name is mishandled, a different vulnerability than CVE-2017-1000421.

Publish Date: 2018-02-02

URL: CVE-2017-18120

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: kohler/gifsicle@118a460

Release Date: 2017-12-03

Fix Resolution: Replace or update the following file: gifread.c

---

Step up your Open Source Security Game with WhiteSource here

[issue-label-bot]

Issue-Label Bot is automatically applying the label bug to this issue, with a confidence of 0.79. Please mark this comment with 👍 or 👎 to give our bot feedback!

Links: app homepage, dashboard and code for this bot.