CVE-2015-7555

low-risk

Published 2016-04-13

Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file.

Do I need to act?

0.30% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (2)

Giflib

Fedora

Affected Vendors

Fedoraproject Giflib Project

References (16)

Vendor Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174876.ht...

Exploit http://packetstormsecurity.com/files/135034/giflib-5.1.1-Heap-Overflow.html

Exploit http://seclists.org/fulldisclosure/2015/Dec/83

http://www-01.ibm.com/support/docview.wss?uid=isg3T1023474

http://www.securityfocus.com/archive/1/537171/100/0/threaded

http://www.securityfocus.com/bid/81697

http://www.securitytracker.com/id/1035331

https://source.android.com/security/bulletin/2017-05-01

Vendor Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174876.ht...

Exploit http://packetstormsecurity.com/files/135034/giflib-5.1.1-Heap-Overflow.html

Exploit http://seclists.org/fulldisclosure/2015/Dec/83

http://www-01.ibm.com/support/docview.wss?uid=isg3T1023474

http://www.securityfocus.com/archive/1/537171/100/0/threaded

http://www.securityfocus.com/bid/81697

http://www.securitytracker.com/id/1035331

https://source.android.com/security/bulletin/2017-05-01

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 7/34 · Low