CVE-2017-16938
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service...
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
- Record
CVE-2017-16938- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
- Record
CVE-2017-16938- Updated
- 2026-11-02
EUVDEUVD-2017-8107 No score
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
- Record
EUVD-2017-8107- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-78q2-wp6j-q4hp
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service...
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
- Record
GHSA-78q2-wp6j-q4hp- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
- Record
CVE-2017-16938- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-16938
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
- Record
DEBIAN-CVE-2017-16938- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-16938
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
- Record
UBUNTU-CVE-2017-16938- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0447 No score
Updated optipng packages fix security vulnerability
- CVE-2017-1000229: Fix integer overflow bug in function minitiff_read_info() allows an attacker to remotely execute code or cause denial of service.
- CVE-2017-16938: Fix a global buffer overflow that allows attackers to cause DoS via a maliciously crafted GIF file.
- Record
MGASA-2017-0447- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11131-1 No score
optipng-0.7.7-2.3 on GA media
These are all security issues fixed in the optipng-0.7.7-2.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11131-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
optipngDebian:12 |
before 0.7.6-1.1 | 0.7.6-1.1 |
optipngDebian:13 |
before 0.7.6-1.1 | 0.7.6-1.1 |
optipngDebian:14 |
before 0.7.6-1.1 | 0.7.6-1.1 |
optipngDebian:7 |
before 0.6.4-1+deb7u4, plus listed versions 0.6.4-10.6.4-1+deb7u10.6.4-1+deb7u20.6.4-1+deb7u3 |
0.6.4-1+deb7u4 |
optipngDebian:8 From an advisory covering 2 CVEs |
before 0.7.5-1+deb8u2, plus listed versions 0.7.5-10.7.5-1+deb8u1 |
0.7.5-1+deb8u2 |
optipngDebian:9 From an advisory covering 2 CVEs |
before 0.7.6-1+deb9u1, plus listed versions 0.7.6-1 |
0.7.6-1+deb9u1 |
optipngMageia:5 From an advisory covering 2 CVEs |
before 0.7.6-1.1.mga5 | 0.7.6-1.1.mga5 |
optipngMageia:6 From an advisory covering 2 CVEs |
before 0.7.6-1.1.mga6 | 0.7.6-1.1.mga6 |
optipngUbuntu:16.04:LTS |
All versions, plus listed versions 0.7.5-10.7.6-10.7.6-1ubuntu0.16.04.1 |
None known |
optipngopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 0.7.7-2.3 | 0.7.7-2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16938 is a high vulnerability (CVSS 7.8) in Optipng Project Optipng, published November 24, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. Fixed in optipng 0.7.6-1.1.
References
lists.debian.org/debian-lts-announce/2017/11/msg00042.html
debian.org/security/2017/dsa-4058
sourceforge.net/p/optipng/bugs/69
security.gentoo.org/glsa/201801-02
nvd.nist.gov/vuln/detail/CVE-2017-16938
github.com/advisories/GHSA-78q2-wp6j-q4hp
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2017-16938
advisories.mageia.org/MGASA-2017-0447.html
bugs.mageia.org/show_bug.cgi?id=22099
ubuntu.com/security/CVE-2017-16938
cve.org/CVERecord?id=CVE-2017-16938
suse.com/security/cve/CVE-2008-5101