Description
Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gifsicle | No fix yet | — |
| Debian 13 | gifsicle | No fix yet | — |
| Debian 12 | gifsicle | No fix yet | — |
References
- https://github.com/kohler/gifsicle/issues/195
- https://github.com/kohler/gifsicle/issues/65
- FEDORA-2024-5e50570506 vendor-advisory
- FEDORA-2024-4672c1ff2d vendor-advisory