Vulnerability · Published Oct 9, 2023 · Assigned by mitre
CVE-2023-44821
Medium 5.5
In plain English
A medium-severity security flaw in the gifsicle package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | gifsicle | no fix listed | DEBIAN-CVE-2023-44821 |
| Debian:13 | gifsicle | no fix listed | DEBIAN-CVE-2023-44821 |
| Debian:14 | gifsicle | no fix listed | DEBIAN-CVE-2023-44821 |