CVE-2023-48161
Publication date 22 November 2023
Last updated 24 July 2024
Ubuntu priority
Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c
Read the notes from the security team
Why is this CVE low priority?
Is only a crash in a CLI tool
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| giflib | 24.04 LTS noble |
Vulnerable
|
| 22.04 LTS jammy |
Vulnerable
|
|
| 20.04 LTS focal |
Vulnerable
|
|
| 18.04 LTS bionic |
Vulnerable
|
|
| 16.04 LTS xenial |
Vulnerable
|
|
| 14.04 LTS trusty | Ignored |
Notes
gianz
as of today (2024-06-06) the issue has not been fixed. the provided PoC works also against the latest version from the repo.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.1 · High
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |