Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4803-1 advisory.

    It was discovered that Gifsicle did not properly handle certain input. If a user were tricked into opening     a malicious GIF, an attacker could potentially execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 1.90 - Fixes CVE-2017-1000421

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that gifsicle, a tool for manipulating GIF image files, contained a flaw that could lead to arbitrary code execution.

It was discovered that there was a use-after-free vulnerability in gifsicle, a command-line tool for manipulating GIF images.

For Debian 7 'Wheezy', this issue has been fixed in gifsicle version 1.67-1.1~deb7u1.

We recommend that you upgrade your gifsicle packages.

(Thanks to Herbert Parentes Fortes Neto for his help in preparing this update.)

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183692	Ubuntu 16.04 ESM : Gifsicle vulnerabilities (USN-4803-1)	Nessus	Ubuntu Local Security Checks	critical
106081	Fedora 26 : gifsicle (2018-6cd2e0e292)	Nessus	Fedora Local Security Checks	critical
105799	Debian DSA-4084-1 : gifsicle - security update	Nessus	Debian Local Security Checks	critical
105660	Debian DLA-1233-1 : gifsicle security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-1000421

critical

Tenable Plugins

critical

critical

critical

critical