Bug 1216077 (CVE-2023-44821)

Summary:	VUL-1: CVE-2023-44821: gifsicle: memory leak via --crop parameter
Product:	[openSUSE] openSUSE Distribution	Reporter:	SMASH SMASH <smash_bz>
Component:	Security	Assignee:	Manfred Schwarb <manfred99>
Status:	RESOLVED WONTFIX	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P4 - Low	CC:	abergmann, Andreas.Stieger
Version:	Leap 15.6
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/381183/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2023-10-10 06:34:59 UTC

Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of service via the --crop parameter in the command line parameters.

References:
https://github.com/kohler/gifsicle/issues/195
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-44821

Comment 1 Andreas Stieger 2023-10-10 07:19:50 UTC

Not a buffer overflow but a simple memory leak. Not remote. The multiple --crop parameters argument is nonsensical.

Comment 2 Manfred Schwarb 2023-10-10 09:53:41 UTC

While some people use gifsicle to automatically manipulate web-provided
images (I think thumblr does it), it is absolutely unrealistic to assume
somebody let the user pass arbitrary command line arguments to gifsicle.

This bug does not deserve a CVE and is probably harmless for normal usage.
Meanwhile, OP admitted the wrong classification and closed the upstream
github issue.

I will close this bug as WONT-FIX.