CVE-2021-40633

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)

giflib is a library of gif images and provides utilities for processing images.

Security Fix(es):

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.(CVE-2021-40633)

A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.

• SECURITY UPDATE: heap buffer over-read in gif2rgb
  • debian/patches/CVE-2020-23922.patch: bound each pixel index against the active color table before indexing ColorMap->Colors in DumpScreen2RGB in util/gif2rgb.c.
  • CVE-2020-23922
• SECURITY UPDATE: memory leak leading to denial of service
  • debian/patches/CVE-2021-40633.patch: free every ScreenBuffer row, not just the row-pointer array, at the end of GIF2RGB in util/gif2rgb.c.
  • CVE-2021-40633
• SECURITY UPDATE: double free in GifMakeSavedImage
  • debian/patches/CVE-2026-23868.patch: null out the heap pointers aliased by the shallow copy of CopyFrom, test the source record when deciding what to deep-copy, and restore ExtensionBlockCount after the extension blocks are copied, in lib/gifalloc.c.
  • CVE-2026-23868

These are all security issues fixed in the giflib-devel-32bit-5.2.2-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2021-40633 in the giflib package for Root:Debian:12. Multiple fixed versions available.

This update for giflib fixes the following issues:

Update to version 5.2.2

• Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
• #138 Documentation for obsolete utilities still installed
• #139: Typo in 'LZW image data' page ('110_2 = 4_10')
• #140: Typo in 'LZW image data' page ('LWZ')
• #141: Typo in 'Bits and bytes' page ('filed')
• Note as already fixed SF issue #143: cannot compile under mingw
• #144: giflib-5.2.1 cannot be build on windows and other platforms using c89
• #145: Remove manual pages installation for binaries that are not installed too
• #146: [PATCH] Limit installed man pages to binaries, move giflib to section 7
• #147 [PATCH] Fixes to doc/whatsinagif/ content
• #148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB
• Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1
• Declared Won't-fix on SF issue 149: Out of source builds no longer possible
• #151: A heap-buffer-overflow in gif2rgb.c:294:45
• #152: Fix some typos on the html documentation and man pages
• #153: Fix segmentation faults due to non correct checking for args
• #154: Recover the giffilter manual page
• #155: Add gifsponge docs
• #157: An OutofMemory-Exception or Memory Leak in gif2rgb
• #158: There is a null pointer problem in gif2rgb
• #159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45
• #163: detected memory leaks in openbsd_reallocarray giflib/openbsd-reallocarray.c
• #164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c
• #166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c
• #167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c

This update for giflib fixes the following issues:

• CVE-2018-11490: Fixed a heap-based buffer overflow in DGifDecompressLine() (bsc#1094832)
• CVE-2021-40633: Fixed a denial of service from excessive memory (bsc#1200551)

It was discovered that GIFLIB incorrectly handled certain GIF files. An attacker could possibly use this issue to cause a denial of service. (CVE-2021-40633, CVE-2022-28506, CVE-2023-39742)