Bug 33257 - gifsicle new security issue CVE-2023-46009
Summary: gifsicle new security issue CVE-2023-46009
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-05-31 10:17 CEST by Nicolas Salguero
Modified: 2024-06-02 05:30 CEST (History)
2 users (show)

See Also:
Source RPM: gifsicle-1.93-2.mga9.src.rpm
CVE: CVE-2023-46009
Status comment:


Attachments

Description Nicolas Salguero 2024-05-31 10:17:52 CEST
SUSE has issued an advisory on May 30:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/XPBVCIDM6CP4OMGHYXCEAOVLORKQFQP4/

The problem is fixed in version 1.95.
Nicolas Salguero 2024-05-31 10:18:15 CEST

Status comment: (none) => Fixed upstream in 1.95
Source RPM: (none) => gifsicle-1.93-2.mga9.src.rpm
CVE: (none) => CVE-2023-46009

Comment 1 Nicolas Salguero 2024-05-31 11:27:53 CEST
Suggested advisory:
========================

The updated package fixes a security vulnerability:

gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c. (CVE-2023-46009)

References:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/XPBVCIDM6CP4OMGHYXCEAOVLORKQFQP4/
========================

Updated package in core/updates_testing:
========================
gifsicle-1.95-1.mga9

from SRPM:
gifsicle-1.95-1.mga9.src.rpm

Assignee: bugsquad => qa-bugs
Status comment: Fixed upstream in 1.95 => (none)
Status: NEW => ASSIGNED

katnatek 2024-06-01 03:45:27 CEST

Keywords: (none) => advisory

Comment 2 katnatek 2024-06-01 05:15:03 CEST
RH mageia 9 x86_64

Install current version

LC_ALL=C urpmi gifsicle 

    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/gifsicle-1.93-2.mga9.x86_64.rpm
installing gifsicle-1.93-2.mga9.x86_64.rpm from /var/cache/urpmi/rpms                                                               
Preparing...                     ##################################################################################################
      1/1: gifsicle              ##################################################################################################

Try POC but look that this only produce the bad output if the application is build with ASAN becuase I have this output even after update

gifsicle --crop 0,0-256,256 --crop-transparency --flip-vertical -i -p 1,1 --rotate-90 --resize=256x256 -o c poc-gifsicle-1.94-1 
gifsicle:poc-gifsicle-1.94-1:#1: read error: unknown block type 0 at file offset 81
gifsicle:poc-gifsicle-1.94-1:#0: read error: missing 4743168 pixels of image data
gifsicle:poc-gifsicle-1.94-1:#1: read error: image corrupted, min_code_size too small

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing gifsicle-1.95-1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: gifsicle              ##################################################################################################
      1/1: removing gifsicle-1.93-2.mga9.x86_64
                                 ##################################################################################################

Reference bug#29458 comment#3
gifsicle --flip-h < original.gif > flip.gif

flip.gif contents the fliped version of original.gif 
gifdiff original.gif  flip.gif
frame #0 pixels differ: 0,0 <#656565 >#717171

I not have animated gif to play 
Looks good to me

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK

Comment 3 Thomas Andrews 2024-06-01 13:54:40 CEST
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 4 Mageia Robot 2024-06-02 05:30:10 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0202.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.