CVE-2015-7802
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial...
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
- Record
CVE-2015-7802- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
- Record
CVE-2015-7802- Updated
- 2026-11-02
EUVDEUVD-2015-7701 No score
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
- Record
EUVD-2015-7701- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3c85-4h37-m8ww
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial...
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
- Record
GHSA-3c85-4h37-m8ww- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
- Record
CVE-2015-7802- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-7802
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
- Record
DEBIAN-CVE-2015-7802- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7802
gifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.
- Record
UBUNTU-CVE-2015-7802- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0135 No score
Updated optipng packages fix security vulnerabilities
An updated optipng package fixes a number of bugs and security vulnerabilities.
CVE-2015-7802 - Buffer over-read issue CVE-2016-2191 - An invalid write and segmentation fault may occur while processing bitmap images
- Record
MGASA-2016-0135- Updated
- 2026-11-02
OSVUSN-2951-1 No score
optipng vulnerabilities
Gustavo Grieco discovered that OptiPNG incorrectly handled memory. A remote attacker could use this issue with a specially crafted image file to cause OptiPNG to crash, resulting in a denial of service. (CVE-2015-7801)
Gustavo Grieco discovered that OptiPNG incorrectly handled memory. A remote attacker could use this issue with a specially crafted image file to cause OptiPNG to crash, resulting in a denial of service. (CVE-2015-7802)
Hans Jerry Illikainen discovered that OptiPNG incorrectly handled memory. A remote attacker could use this issue with a specially crafted image file to cause OptiPNG to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-2191)
Henri Salo discovered that OptiPNG incorrectly handled memory. A remote attacker could use this issue with a specially crafted image file to cause OptiPNG to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-3981)
Henri Salo discovered that OptiPNG incorrectly handled memory. A remote attacker could use this issue with a specially crafted image file to cause OptiPNG to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-3982)
- Record
USN-2951-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
optipngDebian:12 |
before 0.7.6-1 | 0.7.6-1 |
optipngDebian:13 |
before 0.7.6-1 | 0.7.6-1 |
optipngDebian:14 |
before 0.7.6-1 | 0.7.6-1 |
optipngMageia:5 From an advisory covering 2 CVEs |
before 0.7.6-1.mga5 | 0.7.6-1.mga5 |
optipngUbuntu:14.04:LTS |
before 0.6.4-1ubuntu0.14.04.1, plus listed versions 0.6.4-1build1 |
0.6.4-1ubuntu0.14.04.1 |
optipngUbuntu:14.04:LTS From an advisory covering 5 CVEs |
before 0.6.4-1ubuntu0.14.04.1, plus listed versions 0.6.4-1build1 |
0.6.4-1ubuntu0.14.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7802 is a medium vulnerability (CVSS 5.5) in Optipng Project Optipng, published October 12, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in optipng 0.7.6-1.
References
optipng.sourceforge.net/history.txt
ubuntu.com/usn/USN-2951-1
sourceforge.net/p/optipng/bugs/53
nvd.nist.gov/vuln/detail/CVE-2015-7802
github.com/advisories/GHSA-3c85-4h37-m8ww
security-tracker.debian.org/tracker/CVE-2015-7802
Show 11 moreShow less
advisories.mageia.org/MGASA-2016-0135.html
bugs.mageia.org/show_bug.cgi?id=16949
openwall.com/lists/oss-security/2016/04/04/2
ubuntu.com/security/CVE-2015-7802
openwall.com/lists/oss-security/2015/10/10/2
cve.org/CVERecord?id=CVE-2015-7802