Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-44821
HistoryOct 09, 2023 - 12:00 a.m.

CVE-2023-44821

2023-10-0900:00:00
ubuntu.com
ubuntu.com
7
gifsicle
denial of service
memory consumption
untrusted input
gif_realloc calls
unix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

5.1%

DISPUTED Gifsicle through 1.94, if deployed in a way that allows
untrusted input to affect Gif_Realloc calls, might allow a denial of
service (memory consumption). NOTE: this has been disputed by multiple
parties because the Gifsicle code is not commonly used for unattended
operation in which new input arrives for a long-running process, does not
ship with functionality to link it into another application as a library,
and does not have realistic use cases in which an adversary controls the
entire command line.

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

5.1%