CVE-2015-7555
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a...
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
- Record
CVE-2015-7555- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
- Record
CVE-2015-7555- Updated
- 2026-11-02
EUVDEUVD-2015-7469 No score
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
- Record
EUVD-2015-7469- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6rpw-2w6h-fv58
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a...
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
- Record
GHSA-6rpw-2w6h-fv58- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
- Record
CVE-2015-7555- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-7555
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
- Record
DEBIAN-CVE-2015-7555- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2015-7555
Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.
- Record
UBUNTU-CVE-2015-7555- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0020 No score
Updated giflib packages fix security vulnerability
A heap-based buffer overflow vulnerability was found in giffix utility of giflib when processing records of the type 'IMAGE_DESC_RECORD_TYPE' due to the allocated size of 'LineBuffer' equaling the value of the logical screen width, 'GifFileIn->SWidth', while subsequently having 'GifFileIn->Image.Width' bytes of data written to it (CVE-2015-7555).
- Record
MGASA-2016-0020- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10016-1 No score
giflib-devel-32bit-5.1.4-1.12 on GA media
These are all security issues fixed in the giflib-devel-32bit-5.1.4-1.12 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10016-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0192-1 No score
Security update for giflib
This update for giflib fixes the following issues:
- CVE-2015-7555: Heap overflow in giffix (bsc#960319)
- Record
SUSE-SU-2016:0192-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0202-1 No score
Security update for giflib
This update for giflib fixes the following issues:
- CVE-2015-7555: Heap overflow in giffix (bsc#960319)
- bsc#949160: Fix a memory leak
- Record
SUSE-SU-2016:0202-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
giflibDebian:12 |
before 5.1.2-0.1 | 5.1.2-0.1 |
giflibDebian:13 |
before 5.1.2-0.1 | 5.1.2-0.1 |
giflibDebian:14 |
before 5.1.2-0.1 | 5.1.2-0.1 |
giflibDebian:6.0 |
before 4.1.6-9+deb6u1, plus listed versions 4.1.6-9 |
4.1.6-9+deb6u1 |
giflibMageia:5 |
before 4.2.3-4.2.mga5 | 4.2.3-4.2.mga5 |
giflibSUSE:Linux Enterprise Software Development Kit 11 SP3 |
before 4.1.6-13.1 | 4.1.6-13.1 |
giflibSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 4.1.6-13.1 | 4.1.6-13.1 |
giflibSUSE:Linux Enterprise Desktop 11 SP3 |
before 4.1.6-13.1 | 4.1.6-13.1 |
giflibSUSE:Linux Enterprise Desktop 11 SP4 |
before 4.1.6-13.1 | 4.1.6-13.1 |
giflibSUSE:Linux Enterprise Server 11 SP3 |
before 4.1.6-13.1 | 4.1.6-13.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
giflibSUSE:Linux Enterprise Server 11 SP3-TERADATA |
before 4.1.6-13.1 | 4.1.6-13.1 |
giflibSUSE:Linux Enterprise Server for SAP Applications 11 SP3 |
before 4.1.6-13.1 | 4.1.6-13.1 |
giflibSUSE:Linux Enterprise Server 11 SP4 |
before 4.1.6-13.1 | 4.1.6-13.1 |
giflibSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 4.1.6-13.1 | 4.1.6-13.1 |
giflibSUSE:Linux Enterprise Desktop 12 |
before 5.0.5-7.1 | 5.0.5-7.1 |
giflibSUSE:Linux Enterprise Desktop 12 SP1 |
before 5.0.5-7.1 | 5.0.5-7.1 |
giflibSUSE:Linux Enterprise Software Development Kit 12 |
before 5.0.5-7.1 | 5.0.5-7.1 |
giflibSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 5.0.5-7.1 | 5.0.5-7.1 |
giflibSUSE:Linux Enterprise Server 12 |
before 5.0.5-7.1 | 5.0.5-7.1 |
giflibSUSE:Linux Enterprise Server for SAP Applications 12 |
before 5.0.5-7.1 | 5.0.5-7.1 |
giflibSUSE:Linux Enterprise Server 12 SP1 |
before 5.0.5-7.1 | 5.0.5-7.1 |
giflibSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 5.0.5-7.1 | 5.0.5-7.1 |
giflibopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 5.1.4-1.12 | 5.1.4-1.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7555 is a medium vulnerability (CVSS 5.5) in Giflib Project Giflib, published January 15, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 74th percentile. Fixed in giflib 5.1.2-0.1.
References
packetstormsecurity.com/files/135034/giflib-5.1.1-Heap-Overflow.html
www-01.ibm.com/support/docview.wss?uid=isg3T1023474
lists.fedoraproject.org/pipermail/package-announce/2016-January/174876.html
securityfocus.com/archive/1/537171/100/0/threaded
source.android.com/security/bulletin/2017-05-01
securitytracker.com/id/1035331
Show 16 moreShow less
seclists.org/fulldisclosure/2015/Dec/83
nvd.nist.gov/vuln/detail/CVE-2015-7555
github.com/advisories/GHSA-6rpw-2w6h-fv58
security-tracker.debian.org/tracker/CVE-2015-7555
advisories.mageia.org/MGASA-2016-0020.html
bugs.mageia.org/show_bug.cgi?id=17376
suse.com/support/update/announcement/2016/suse-su-20160192-1
bugzilla.suse.com/960319
ubuntu.com/security/CVE-2015-7555
cve.org/CVERecord?id=CVE-2015-7555