libungif library before 4.1.0 allows attackers to cause a denial of service via a crafted GIF file that triggers a null dereference.

From Red Hat Security Advisory 2009:0444 :

Updated giflib packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The giflib packages contain a shared library of functions for loading and saving GIF image files. This library is API and ABI compatible with libungif, the library that supported uncompressed GIF image files while the Unisys LZW patent was in effect.

Several flaws were discovered in the way giflib decodes GIF images. An attacker could create a carefully crafted GIF image that could cause an application using giflib to crash or, possibly, execute arbitrary code when opened by a victim. (CVE-2005-2974, CVE-2005-3350)

All users of giflib are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. All running applications using giflib must be restarted for the update to take effect.

Several flaws were discovered in the way giflib decodes GIF images. An attacker could create a carefully crafted GIF image that could cause an application using giflib to crash or, possibly, execute arbitrary code when opened by a victim. (CVE-2005-2974, CVE-2005-3350)

All running applications using giflib must be restarted for the update to take effect.

Updated giflib packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The giflib packages contain a shared library of functions for loading and saving GIF image files. This library is API and ABI compatible with libungif, the library that supported uncompressed GIF image files while the Unisys LZW patent was in effect.

Several flaws were discovered in the way giflib decodes GIF images. An attacker could create a carefully crafted GIF image that could cause an application using giflib to crash or, possibly, execute arbitrary code when opened by a victim. (CVE-2005-2974, CVE-2005-3350)

All users of giflib are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. All running applications using giflib must be restarted for the update to take effect.

This update fixes the following security issues :

  - specially crafted GIF files could crash applications.
    (CVE-2005-2974)

  - specially crafted GIF files could overwrite memory which     potentially allowed to execute arbitrary code.
    (CVE-2005-3350)

- Update to 4.1.6 containing several upstream fixes etc. -     Solved multilib problems with documentation (#465208,     #474538) - Removed static library from giflib-devel     package (#225796 #c1)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2005-2974: NULL pointer dereference crash (#494826)
    - CVE-2005-3350: Memory corruption via a crafted GIF     (#494823) - Solved multilib problems with documentation     (#465208, #474538) - Removed static library from     giflib-devel package (#225796 #c1)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0444 advisory.

    The giflib packages contain a shared library of functions for loading and     saving GIF image files. This library is API and ABI compatible with     libungif, the library that supported uncompressed GIF image files while the     Unisys LZW patent was in effect.

    Several flaws were discovered in the way giflib decodes GIF images. An     attacker could create a carefully crafted GIF image that could cause an     application using giflib to crash or, possibly, execute arbitrary code when     opened by a victim. (CVE-2005-2974, CVE-2005-3350)

    All users of giflib are advised to upgrade to these updated packages, which     contain backported patches to resolve these issues. All running     applications using giflib must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chris Evans discovered several security related problems in libungif4, a shared library for GIF images. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2005-2974     NULL pointer dereference, that could cause a denial of     service.

  - CVE-2005-3350     Out of bounds memory access that could cause a denial of     service or the execution of arbitrary code.

Updated libungif packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libungif package contains a shared library of functions for loading and saving GIF format image files.

Several bugs in the way libungif decodes GIF images were discovered.
An attacker could create a carefully crafted GIF image file in such a way that it could cause an application linked with libungif to crash or execute arbitrary code when the file is opened by a victim. The Common Vulnerabilities and Exposures project has assigned the names CVE-2005-2974 and CVE-2005-3350 to these issues.

All users of libungif are advised to upgrade to these updated packages, which contain backported patches that resolve these issues.

Chris Evans discovered several buffer overflows in the libungif library. By tricking an user (or automated system) into processing a specially crafted GIF image, this could be exploited to execute arbitrary code with the privileges of the application using libungif.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several bugs have been discovered in the way libungif decodes GIF images. These allow an attacker to create a carefully crafted GIF image file in such a way that it could cause applications linked with libungif to crash or execute arbitrary code when the file is opened by the user.

The updated packages have been patched to address this issue.

The remote host is affected by the vulnerability described in GLSA-200511-03 (giflib: Multiple vulnerabilities)

    Chris Evans and Daniel Eisenbud independently discovered two     out-of-bounds memory write operations and a NULL pointer dereference in     giflib.
  Impact :

    An attacker could craft a malicious GIF image and entice users to     load it using an application making use of the giflib library,     resulting in an application crash or potentially the execution of     arbitrary code.
  Workaround :

    There is no known workaround at this time.

The libungif package contains a shared library of functions for loading and saving GIF format image files. The libungif library can load any GIF file, but it will save GIFs only in uncompressed format;
it will not use the patented LZW compression used to save 'normal' compressed GIF files.

A bug was found in the way libungif handles colormaps. An attacker could create a GIF file in such a way that could cause out-of-bounds writes and register corruptions. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2974 to this issue.

All users of libungif should upgrade to the updated packages, which contain a backported patch to resolve this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67849	Oracle Linux 5 : giflib (ELSA-2009-0444)	Nessus	Oracle Linux Local Security Checks	high
60574	Scientific Linux Security Update : giflib on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43744	CentOS 5 : giflib (CESA-2009:0444)	Nessus	CentOS Local Security Checks	high
41083	SuSE9 Security Update : libungif (YOU Patch Number 10556)	Nessus	SuSE Local Security Checks	high
39453	Fedora 10 : giflib-4.1.6-2.fc10 (2009-4848)	Nessus	Fedora Local Security Checks	high
38812	Fedora 9 : giflib-4.1.3-10.fc9 (2009-5118)	Nessus	Fedora Local Security Checks	high
37605	RHEL 5 : giflib (RHSA-2009:0444)	Nessus	Red Hat Local Security Checks	high
22756	Debian DSA-890-1 : libungif4 - several vulnerabilities	Nessus	Debian Local Security Checks	high
21869	CentOS 3 / 4 : libungif (CESA-2005:828)	Nessus	CentOS Local Security Checks	high
20632	Ubuntu 4.10 / 5.04 / 5.10 : libungif4 vulnerabilities (USN-214-1)	Nessus	Ubuntu Local Security Checks	high
20441	Mandrake Linux Security Advisory : libungif (MDKSA-2005:207)	Nessus	Mandriva Local Security Checks	high
20153	GLSA-200511-03 : giflib: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
20145	RHEL 2.1 / 3 / 4 : libungif (RHSA-2005:828)	Nessus	Red Hat Local Security Checks	high
20139	Fedora Core 4 : libungif-4.1.3-3.fc4.2 (2005-1046)	Nessus	Fedora Local Security Checks	low
20138	Fedora Core 3 : libungif-4.1.3-1.fc3.2 (2005-1045)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2005-2974

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

low

low