CVE-2011-2896
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 12.0%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 11.99% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- swi-prolog/swi-prolog · apple/cups · gimp/gimp
- Source
- secalert@redhat.com
References
- http://cups.org/str.php?L3867Patch, Third Party Advisory
- http://git.gnome.org/browse/gimp/commit/?id=376ad788c1a1c31d40f18494889c383f6909ebfcPatch, Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/064600.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/064873.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065527.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065539.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065550.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065651.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1180.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1181.htmlThird Party Advisory
- http://secunia.com/advisories/45621Broken Link
- http://secunia.com/advisories/45900Broken Link
- http://secunia.com/advisories/45945Broken Link
- http://secunia.com/advisories/45948Broken Link
- http://secunia.com/advisories/46024Broken Link
- http://secunia.com/advisories/48236Broken Link
- http://secunia.com/advisories/48308Broken Link
- http://secunia.com/advisories/50737Broken Link
- http://security.gentoo.org/glsa/glsa-201209-23.xmlThird Party Advisory
- http://www.debian.org/security/2011/dsa-2354Third Party Advisory
- http://www.debian.org/security/2012/dsa-2426Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:146Broken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:167Broken Link
- http://www.openwall.com/lists/oss-security/2011/08/10/10Mailing List, Patch, Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1635.htmlBroken Link
- http://www.securityfocus.com/bid/49148Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1025929Broken Link, Third Party Advisory, VDB Entry
- http://www.swi-prolog.org/bugzilla/show_bug.cgi?id=7#c4Issue Tracking, Third Party Advisory
- http://www.ubuntu.com/usn/USN-1207-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1214-1Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.