Bug 1216077 (CVE-2023-44821) - VUL-1: CVE-2023-44821: gifsicle: memory leak via --crop parameter
Summary: VUL-1: CVE-2023-44821: gifsicle: memory leak via --crop parameter
Status: RESOLVED WONTFIX
Alias: CVE-2023-44821
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P4 - Low : Minor (vote)
Target Milestone: ---
Assignee: Manfred Schwarb
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/381183/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-10 06:34 UTC by SMASH SMASH
Modified: 2023-10-10 09:53 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2023-10-10 06:34:59 UTC 
Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of service via the --crop parameter in the command line parameters.

References:
https://github.com/kohler/gifsicle/issues/195
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-44821
Comment 1 Andreas Stieger 2023-10-10 07:19:50 UTC 
Not a buffer overflow but a simple memory leak. Not remote. The multiple --crop parameters argument is nonsensical.
Comment 2 Manfred Schwarb 2023-10-10 09:53:41 UTC 
While some people use gifsicle to automatically manipulate web-provided
images (I think thumblr does it), it is absolutely unrealistic to assume
somebody let the user pass arbitrary command line arguments to gifsicle.

This bug does not deserve a CVE and is probably harmless for normal usage.
Meanwhile, OP admitted the wrong classification and closed the upstream
github issue.

I will close this bug as WONT-FIX.