CVE-2018-11489

HIGH EPSS 83.4%
Published May 26, 20188y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published May 26, 2018 8y ago
Last Modified Jun 17, 2026 2w ago

Description

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain CrntCode array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
83.4% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 2

CWE-129
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 2

VendorProductVersionRange
giflib_projectgiflib*≥3.0  –  ≤3.1.1
sam2p_projectsam2p0.49.4any

References 3

  • securityfocus.com http://www.securityfocus.com/bid/104341
    Third Party AdvisoryVDB Entry
  • github.com https://github.com/pts/sam2p/issues/37
    ExploitIssue TrackingThird Party Advisory
  • lists.apache.org https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.