[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <543-67f6e580-2d-5396a400@170623133>
Date: Wed, 09 Apr 2025 23:23:53 +0200
From: Bernhard Rosenkränzer <bero@...dev.ch>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-31344: giflib: The giflib open-source component has a buffer
overflow vulnerability.
On Wednesday, April 09, 2025 23:11 CEST, Sebastian Pipping <sebastian@...ping.org> wrote:
> https://github.com/openwrt/packages/issues/26277
Except for https://sourceforge.net/p/giflib/bugs/179/, all the issues seem to be in gif2rgb, which is, according to the giflib maintainer, "old and crappy code", and TBH, other than as a no-dependency test tool for giflib, it is fairly useless (just use ImageMagick or a similar tool to do the gif to rgb conversion).
Simply removing the gif2rgb tool is probably an acceptable solution.
ttyl
bero
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
