CVE-2018-11490

HIGH EPSS 82.6%

Published May 26, 20188y ago · Modified Jun 17, 20262w ago

8.8 CVSS 3.1

High

Published May 26, 2018 8y ago

Last Modified Jun 17, 2026 2w ago

Description

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

CVSS Details

Base Score

8.8

Exploitability

2.8

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

82.6% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-129

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 6

Vendor	Product	Version	Range
giflib_project	giflib	*	≥3.0 – ≤3.1.1
sam2p_project	sam2p	0.49.4	any
debian	debian_linux	10.0	any
canonical	ubuntu_linux	16.04	any
canonical	ubuntu_linux	18.04	any
canonical	ubuntu_linux	19.04	any

References 4

securityfocus.com http://www.securityfocus.com/bid/104327

Third Party AdvisoryVDB Entry
github.com https://github.com/pts/sam2p/issues/38

Third Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2022/12/msg00008.html

Mailing ListThird Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/4107-1/

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.