{"id":"CVE-2020-23922","aliases":["CLSA-2026-1781348390","CLSA-2026-1787646995","DEBIAN-CVE-2020-23922","EUVD-2020-16659","GHSA-6xhw-5p38-q4xw","JLSEC-2026-815","OESA-2024-1757","ROOT-OS-DEBIAN-12-CVE-2020-23922"],"status":"published","title":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based...","description":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02237,"percentile":0.82923,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2021-04-21T17:41:06Z","modified":"2026-10-26T12:00:51Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"giflib","fixed_in":["5.2.1-9.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"giflib-devel","fixed_in":["5.2.1-9.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"giflib-utils","fixed_in":["5.2.1-9.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"giflib","fixed_in":["5.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"giflib","fixed_in":["5.2.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Giflib_jll","fixed_in":["5.2.1+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"giflib","fixed_in":["5.2.1-2.5+deb12u1.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-giflib","fixed_in":["5.2.1-2.5+deb12u1.aikido.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-9.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"giflib-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-9.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"giflib-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-9.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"giflib-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgif-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgif7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.1-2.5","5.2.1-2.5+deb12u1","5.2.2-1","6.1.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"Giflib_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.1+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-1.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:12","package":"giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-2.5+deb12u1.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-giflib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-2.5+deb12u1.aikido.8"}]}]}],"products":[{"vendor":"apache","product":"bookkeeper"},{"vendor":"giflib_project","product":"giflib"}],"references":[{"url":"https://sourceforge.net/p/giflib/bugs/151/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cwe.mitre.org/data/definitions/126.html","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-23922","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-6xhw-5p38-q4xw"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1781348390.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28506","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787646995.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23868","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-23922","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1757","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48161","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-23922","description":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.","status":"published","published":"2021-04-21T17:41:06Z","modified":"2024-08-04T15:05:11.276Z","updated_at":"2026-11-02T14:35:49.209579Z"}],"euvd":[{"id":"EUVD-2020-16659","description":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.","status":"published","published":"2021-04-21T17:41:06Z","modified":"2024-08-04T15:05:11Z","updated_at":"2026-11-03T03:07:20.733107Z"}],"ghsa":[{"id":"GHSA-6xhw-5p38-q4xw","title":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based...","description":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.","status":"published","published":"2022-05-24T17:48:03Z","modified":"2023-01-27T05:02:54Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:42:07.495183Z"}],"nvd":[{"id":"CVE-2020-23922","description":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.","status":"published","published":"2021-04-21T18:15:08.347Z","modified":"2026-06-17T03:05:05.603Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:39.25999Z"}],"osv":[{"id":"CVE-2020-23922","description":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.","status":"published","published":"2021-04-21T18:15:08.347Z","modified":"2026-10-24T10:30:33.779143895Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.534837Z"},{"id":"DEBIAN-CVE-2020-23922","description":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.","status":"published","published":"2021-04-21T18:15:08.347Z","modified":"2026-10-26T12:00:51.269905865Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"JLSEC-2026-815","description":"An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.","status":"published","published":"2026-07-30T15:01:04.165Z","modified":"2026-07-30T15:15:05.086622573Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2024-1757","title":"giflib security update","description":"giflib is a library of gif images and provides utilities for processing images.\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.(CVE-2020-23922)\r\n\r\nBuffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c(CVE-2023-48161)","status":"published","published":"2024-06-28T11:07:13Z","modified":"2026-08-18T01:17:24.756706683Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"CLSA-2026-1781348390","title":"giflib: Fix of 2 CVEs","description":"- CVE-2020-23922: fix heap out-of-bounds read in DumpScreen2RGB","status":"published","published":"2026-06-13T11:00:42Z","modified":"2026-10-26T09:30:20.293799446Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1787646995","title":"Fix CVE(s): CVE-2020-23922, CVE-2021-40633, CVE-2026-23868","description":"   * SECURITY UPDATE: heap buffer over-read in gif2rgb\n     - debian/patches/CVE-2020-23922.patch: bound each pixel index against\n       the active color table before indexing ColorMap-\u003eColors in\n       DumpScreen2RGB in util/gif2rgb.c.\n     - CVE-2020-23922\n   * SECURITY UPDATE: memory leak leading to denial of service\n     - debian/patches/CVE-2021-40633.patch: free every ScreenBuffer row, not\n       just the row-pointer array, at the end of GIF2RGB in\n       util/gif2rgb.c.\n     - CVE-2021-40633\n   * SECURITY UPDATE: double free in GifMakeSavedImage\n     - debian/patches/CVE-2026-23868.patch: null out the heap pointers\n       aliased by the shallow copy of CopyFrom, test the source record when\n       deciding what to deep-copy, and restore ExtensionBlockCount after the\n       extension blocks are copied, in lib/gifalloc.c.\n     - CVE-2026-23868","status":"published","published":"2026-08-25T08:36:48Z","modified":"2026-10-26T09:30:42.804789392Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2020-23922","title":"CVE-2020-23922 in giflib - Patched by Root","description":"Root has patched CVE-2020-23922 in the giflib package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-27T12:28:51Z","modified":"2026-08-27T13:45:03.614862654Z","updated_at":"2026-11-02T15:53:30.70924Z"}]}}