Stack-based buffer overflow in gif2png.c in gif2png 2.5.3 and earlier might allow context-dependent attackers to execute arbitrary code via a long command-line argument, as demonstrated by a CGI program that launches gif2png.

A vulnerability has been found and corrected in gif2png :

Stack-based buffer overflow in gif2png.c in gif2png 2.5.3 and earlier might allow context-dependent attackers to execute arbitrary code via a long command-line argument, as demonstrated by a CGI program that launches gif2png (CVE-2009-5018).

Buffer overflow in gif2png.c in gif2png 2.5.3 and earlier might allow context-dependent attackers to cause a denial of service (application crash) or have unspecified other impact via a GIF file that contains many images, leading to long extensions such as .p100 for PNG output files, as demonstrated by a CGI program that launches gif2png, a different vulnerability than CVE-2009-5018 (CVE-2010-4694).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-201101-01 (gif2png: User-assisted execution of arbitrary code)

    gif2png contains a command line parsing vulnerability that may result     in a stack overflow due to an unexpectedly long input filename.
  Impact :

    A remote attacker could entice a user to open a specially crafted     image, possibly resulting in the execution of arbitrary code with the     privileges of the user running the application, or a Denial of Service.
    Note that applications relying on gif2png to process images can also     trigger the vulnerability.
  Workaround :

    There is no known workaround at this time.

- Tue Jan 5 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 2.5.1-1202

    - catch another possible overflow when appending a       numbered suffix (detected to Tomas Hoger)

  - Sat Jan 2 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 2.5.1-1201

    - changed -overflow patch to abort on bad filenames       instead of processing truncated ones

  - Fri Jan 1 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 2.5.1-1200

    - fixed command line buffer overflow (#547515)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
51801	Mandriva Linux Security Advisory : gif2png (MDVSA-2011:009)	Nessus	Mandriva Local Security Checks	medium
51416	GLSA-201101-01 : gif2png: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
50669	Fedora 12 : gif2png-2.5.1-1202.fc12 (2010-0358)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-5018

critical

Tenable Plugins

medium

medium

medium