CVE-2015-8808

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to...

5.5 MediumFix available

CVE-2015-8808 is a medium vulnerability (CVSS 5.5) in Graphicsmagick, published May 21, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 74th percentile. Fixed in graphicsmagick 1.3.21-2.

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.54%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.5

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.

Record: CVE-2015-8808
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.

Record: CVE-2015-8808
Updated: 2026-11-02

EUVDEUVD-2015-8676 No score

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.

Record: EUVD-2015-8676
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wjfm-jff2-jgf3 5.5

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to...

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.

Record: GHSA-wjfm-jff2-jgf3
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 5.5

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.

Record: CVE-2015-8808
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-8808 5.5

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.

Record: DEBIAN-CVE-2015-8808
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-8808 5.5

The DecodeImage function in coders/gif.c in GraphicsMagick 1.3.18 allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted GIF file.

Record: UBUNTU-CVE-2015-8808
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVSUSE-SU-2016:1614-1 No score

Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issues:

CVE-2016-5118: popen() shell vulnerability via special filenames (bnc#982178).
CVE-2013-4589: The ExportAlphaQuantumType function in export.c in GraphicsMagick might have allowed remote attackers to cause a denial of service (crash) via vectors related to exporting the alpha of an 8-bit RGBA image (bsc#851064).
CVE-2015-8808: Out-of-bound read in the parsing of GIF files (bnc#965574).

Record: SUSE-SU-2016:1614-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`graphicsmagick` Debian:12	before 1.3.21-2	1.3.21-2
`graphicsmagick` Debian:13	before 1.3.21-2	1.3.21-2
`graphicsmagick` Debian:14	before 1.3.21-2	1.3.21-2
`graphicsmagick` Debian:7	before 1.3.16-1.1+deb7u1, plus listed versions 1.3.16-1.1	1.3.16-1.1+deb7u1
`graphicsmagick` Debian:8	before 1.3.20-3+deb8u2, plus listed versions 1.3.20-3+deb8u1	1.3.20-3+deb8u2
`GraphicsMagick` SUSE:Linux Enterprise Software Development Kit 11 SP4	before 1.2.5-4.38.1	1.2.5-4.38.1
`GraphicsMagick` SUSE:Studio Onsite 1.3	before 1.2.5-4.38.1	1.2.5-4.38.1
`graphicsmagick` Ubuntu:14.04:LTS	before 1.3.18-1ubuntu3.1, plus listed versions 1.3.16-1.1ubuntu21.3.16-1.1ubuntu31.3.18-1ubuntu3	1.3.18-1ubuntu3.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 14 moreShow less