{"id":"CVE-2023-44821","aliases":["DEBIAN-CVE-2023-44821","EUVD-2023-49144","GHSA-vqf3-8wjf-vm68"],"status":"disputed","title":"Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of...","description":"Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00329,"percentile":0.26338,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-401"],"published":"2023-10-09T00:00:00Z","modified":"2026-10-28T02:30:59Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"gifsicle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.93-2","1.94-1","1.95-1","1.95-2","1.96-1","1.97-1","1.98-1"]},{"source":"osv","ecosystem":"Debian:13","package":"gifsicle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.96-1","1.97-1","1.98-1"]},{"source":"osv","ecosystem":"Debian:14","package":"gifsicle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.96-1","1.97-1","1.98-1"]}],"products":[{"vendor":"lcdf","product":"gifsicle"}],"references":[{"url":"https://github.com/kohler/gifsicle/issues/195","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/kohler/gifsicle/issues/65","tags":["x_transferred","Exploit","Issue Tracking","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44821","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF"},{"url":"https://github.com/advisories/GHSA-vqf3-8wjf-vm68"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44821.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-44821","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-44821","description":"Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.","status":"disputed","published":"2023-10-09T00:00:00Z","modified":"2025-11-04T18:17:28.556Z","updated_at":"2026-11-02T14:35:21.612665Z"}],"euvd":[{"id":"EUVD-2023-49144","description":"Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.","status":"published","published":"2023-10-09T00:00:00Z","modified":"2025-11-04T18:17:28Z","updated_at":"2026-11-02T19:49:24.543935Z"}],"ghsa":[{"id":"GHSA-vqf3-8wjf-vm68","title":"Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of...","description":"Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of service via the --crop parameter in the command line parameters.","status":"published","published":"2023-10-09T21:30:27Z","modified":"2026-03-20T05:06:11Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:06:44.064136Z"}],"nvd":[{"id":"CVE-2023-44821","description":"Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.","status":"disputed","published":"2023-10-09T20:15:10.583Z","modified":"2026-06-17T06:27:49.337Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:08:36.656095Z"}],"osv":[{"id":"DEBIAN-CVE-2023-44821","description":"Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.","status":"published","published":"2023-10-09T20:15:10.583Z","modified":"2026-10-26T18:02:07.972597306Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"CVE-2023-44821","description":"Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.","status":"published","published":"2023-10-09T00:00:00Z","modified":"2026-10-28T02:30:59.199637372Z","updated_at":"2026-11-02T15:44:33.792101Z"}]}}