giflib security update

2009-04-2320:53:06

CentOS Project

lists.centos.org

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.033 Low

EPSS

Percentile

91.4%

JSON

CentOS Errata and Security Advisory CESA-2009:0444

The giflib packages contain a shared library of functions for loading and
saving GIF image files. This library is API and ABI compatible with
libungif, the library that supported uncompressed GIF image files while the
Unisys LZW patent was in effect.

Several flaws were discovered in the way giflib decodes GIF images. An
attacker could create a carefully crafted GIF image that could cause an
application using giflib to crash or, possibly, execute arbitrary code when
opened by a victim. (CVE-2005-2974, CVE-2005-3350)

All users of giflib are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. All running
applications using giflib must be restarted for the update to take effect.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2009-April/077990.html
https://lists.centos.org/pipermail/centos-announce/2009-April/077991.html

Affected packages:
giflib
giflib-devel
giflib-utils

Upstream details at:
https://access.redhat.com/errata/RHSA-2009:0444

OSVersionArchitecturePackageVersionFilename
CentOS5i386giflib< 4.1.3-7.1.el5_3.1giflib-4.1.3-7.1.el5_3.1.i386.rpm
CentOS5i386giflib-devel< 4.1.3-7.1.el5_3.1giflib-devel-4.1.3-7.1.el5_3.1.i386.rpm
CentOS5i386giflib-utils< 4.1.3-7.1.el5_3.1giflib-utils-4.1.3-7.1.el5_3.1.i386.rpm
CentOS5i386giflib< 4.1.3-7.1.el5_3.1giflib-4.1.3-7.1.el5_3.1.i386.rpm
CentOS5i386giflib-devel< 4.1.3-7.1.el5_3.1giflib-devel-4.1.3-7.1.el5_3.1.i386.rpm
CentOS5i386giflib-utils< 4.1.3-7.1.el5_3.1giflib-utils-4.1.3-7.1.el5_3.1.i386.rpm
CentOS5i386giflib< 4.1.3-7.1.el5_3.1giflib-4.1.3-7.1.el5_3.1.i386.rpm
CentOS5x86_64giflib< 4.1.3-7.1.el5_3.1giflib-4.1.3-7.1.el5_3.1.x86_64.rpm
CentOS5i386giflib-devel< 4.1.3-7.1.el5_3.1giflib-devel-4.1.3-7.1.el5_3.1.i386.rpm
CentOS5x86_64giflib-devel< 4.1.3-7.1.el5_3.1giflib-devel-4.1.3-7.1.el5_3.1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	5	i386	giflib	< 4.1.3-7.1.el5_3.1	giflib-4.1.3-7.1.el5_3.1.i386.rpm
CentOS	5	i386	giflib-devel	< 4.1.3-7.1.el5_3.1	giflib-devel-4.1.3-7.1.el5_3.1.i386.rpm
CentOS	5	i386	giflib-utils	< 4.1.3-7.1.el5_3.1	giflib-utils-4.1.3-7.1.el5_3.1.i386.rpm
CentOS	5	i386	giflib	< 4.1.3-7.1.el5_3.1	giflib-4.1.3-7.1.el5_3.1.i386.rpm
CentOS	5	i386	giflib-devel	< 4.1.3-7.1.el5_3.1	giflib-devel-4.1.3-7.1.el5_3.1.i386.rpm
CentOS	5	i386	giflib-utils	< 4.1.3-7.1.el5_3.1	giflib-utils-4.1.3-7.1.el5_3.1.i386.rpm
CentOS	5	i386	giflib	< 4.1.3-7.1.el5_3.1	giflib-4.1.3-7.1.el5_3.1.i386.rpm
CentOS	5	x86_64	giflib	< 4.1.3-7.1.el5_3.1	giflib-4.1.3-7.1.el5_3.1.x86_64.rpm
CentOS	5	i386	giflib-devel	< 4.1.3-7.1.el5_3.1	giflib-devel-4.1.3-7.1.el5_3.1.i386.rpm
CentOS	5	x86_64	giflib-devel	< 4.1.3-7.1.el5_3.1	giflib-devel-4.1.3-7.1.el5_3.1.x86_64.rpm