Log in Start free

Vulnerability · Published Apr 27, 2022 · Assigned by @huntrdev

CVE-2022-1507chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in hpjansson/chafa

Medium 5.5

In plain English

A medium-severity null pointer dereference in hpjansson/chafa from hpjansson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)5.5Medium
Exploit odds (30 days)0.9%top 40.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12chafa1.10.2-1DEBIAN-CVE-2022-1507
Debian:13chafa1.10.2-1DEBIAN-CVE-2022-1507
Debian:14chafa1.10.2-1DEBIAN-CVE-2022-1507
Ubuntu:22.04:LTSchafano fix listedUBUNTU-CVE-2022-1507

Affected products (as reported)

VendorProductVersions
hpjansson hpjansson/chafa unspecified – before 1.10.2

Weakness: CWE-476 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References