Skip to content
OpenAdvisories
Unscored CVE-2023-44821 EUVD-2023-49144GHSA-vqf3-8wjf-vm68

Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memor…

Published Oct 9, 2023 · Updated Nov 4, 2025 · Assigned by mitre

Description

Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 gifsicle No fix yet —
Debian 13 gifsicle No fix yet —
Debian 12 gifsicle No fix yet —

References