Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-28506: There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB() in gif2rgb.c:298:45. CVE-2020-23922: An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | giflib | 0:5.2.1-9.amzn2023 |
| Amazon Linux · 2023 | giflib-debuginfo | 0:5.2.1-9.amzn2023 |
| Amazon Linux · 2023 | giflib-debugsource | 0:5.2.1-9.amzn2023 |
| Amazon Linux · 2023 | giflib-devel | 0:5.2.1-9.amzn2023 |
| Amazon Linux · 2023 | giflib-utils | 0:5.2.1-9.amzn2023 |
| Amazon Linux · 2023 | giflib-utils-debuginfo | 0:5.2.1-9.amzn2023 |
Vulnerabilities 2
-
Unscored —
An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read.
-
Unscored —
There is a heap-buffer-overflow in GIFLIB 5.2.1 function DumpScreen2RGB() in gif2rgb.c:298:45.