Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 830138 (CVE-2021-45907, CVE-2021-45908, CVE-2021-45909, CVE-2021-45910, CVE-2021-45911) - media-gfx/gif2apng: multiple vulnerabilities
Summary: media-gfx/gif2apng: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2021-45907, CVE-2021-45908, CVE-2021-45909, CVE-2021-45910, CVE-2021-45911
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~2 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-12-28 06:41 UTC by John Helmert III
Modified: 2022-09-18 21:25 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-12-28 06:41:35 UTC
CVE-2021-45907 (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002669):

An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted.

CVE-2021-45908 (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002669):

An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted.

CVE-2021-45909 (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002668):

An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function. It allows an attacker to write a large amount of arbitrary data outside the boundaries of a buffer.

CVE-2021-45910 (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002667):

An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an attacker to write data outside of the allocated buffer. The attacker has control over a part of the address that data is written to, control over the written data, and (to some extent) control over the amount of data that is written.

CVE-2021-45911 (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002687):

An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attacker to write 2 bytes outside the boundaries of the buffer.
Comment 1 Larry the Git Cow gentoo-dev 2022-08-16 20:52:13 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=da55a3f4fd94d954b5f044f6b9dc886c38fb1238

commit da55a3f4fd94d954b5f044f6b9dc886c38fb1238
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2022-08-16 20:48:14 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-08-16 20:52:09 +0000

    profiles: last rite gif2apng
    
    Bug: https://bugs.gentoo.org/830138
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 profiles/package.mask | 5 +++++
 1 file changed, 5 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2022-09-18 21:23:35 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c4d2c0e07411617118ee243e79284dac8ceba2a8

commit c4d2c0e07411617118ee243e79284dac8ceba2a8
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2022-09-18 21:11:09 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-09-18 21:12:53 +0000

    media-gfx/gif2apng: treeclean
    
    Bug: https://bugs.gentoo.org/830138
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 media-gfx/gif2apng/Manifest                        |  1 -
 .../gif2apng/files/gif2apng-1.9-makefile.patch     | 18 ----------
 media-gfx/gif2apng/gif2apng-1.9-r1.ebuild          | 38 ----------------------
 media-gfx/gif2apng/metadata.xml                    |  8 -----
 profiles/package.mask                              |  9 ++---
 5 files changed, 2 insertions(+), 72 deletions(-)