Bug 34178 - giflib new security issue CVE-2025-31344
Summary: giflib new security issue CVE-2025-31344
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-04-09 10:57 CEST by Nicolas Salguero
Modified: 2025-04-12 21:05 CEST (History)
3 users (show)

See Also:
Source RPM: giflib-5.2.1-7.1.mga9.src.rpm
CVE: CVE-2025-31344
Status comment:


Attachments

Description Nicolas Salguero 2025-04-09 10:57:32 CEST
CVE-2025-31344 was announced here:
https://www.openwall.com/lists/oss-security/2025/04/07/3
Nicolas Salguero 2025-04-09 10:58:01 CEST

Source RPM: (none) => giflib-5.2.2-1.mga10.src.rpm, giflib-5.2.1-7.1.mga9.src.rpm
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2025-31344

Comment 1 Nicolas Salguero 2025-04-09 14:40:36 CEST
SUSE has issued an advisory on April 8:
https://lists.suse.com/pipermail/sle-updates/2025-April/038931.html

Status comment: (none) => Patch available from SUSE

Comment 2 Lewis Smith 2025-04-09 20:02:26 CEST
Sorry, cannot find the patch.

Assigning globally; different people have maintained this pkg.

Assignee: bugsquad => pkg-bugs

Comment 3 Nicolas Salguero 2025-04-11 10:31:04 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

The giflib open-source component has a buffer overflow vulnerability. (CVE-2025-31344)

References:
https://www.openwall.com/lists/oss-security/2025/04/07/3
https://lists.suse.com/pipermail/sle-updates/2025-April/038931.html
========================

Updated packages in core/updates_testing:
========================
giflib-progs-5.2.1-7.2.mga9
lib(64)gif7-5.2.1-7.2.mga9
lib(64)gif-devel-5.2.1-7.2.mga9

from SRPM:
giflib-5.2.1-7.2.mga9.src.rpm

Status: NEW => ASSIGNED
Status comment: Patch available from SUSE => (none)
Version: Cauldron => 9
Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA9TOO => (none)
Source RPM: giflib-5.2.2-1.mga10.src.rpm, giflib-5.2.1-7.1.mga9.src.rpm => giflib-5.2.1-7.1.mga9.src.rpm

Comment 4 Herman Viaene 2025-04-11 14:50:06 CEST
MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Ref bug 32303 for tests.

$ giftool -f "%v\n%w x %h\n" < wapen_merksem.gif
GIF89a
50 x 60
$ giftext -c < wapen_merksem.gif

Stdin:

        Screen Size - Width = 50, Height = 60.
        ColorResolution = 8, BitsPerPixel = 8, BackGround = 0, Aspect = 0.
        Has Global Color Map.

        Global Color Map:
        Sort Flag: off
  0: bch bdh c4h     1: e4h dch deh     2: f3h eeh eeh     3: f9h f8h f6h   
  4: fbh fch fch     5: feh fdh feh     6: ffh feh ffh     7: ffh ffh ffh 
etc... at the end
GIF89 graphics control (Ext Code = 249 [ ]):
        Disposal Mode: 0
        User Input Flag: 0
        Transparency on: no
        DelayTime: 0
        Transparent Index: -1

Image #1:

        Image Size - Left = 0, Top = 0, Width = 50, Height = 60.
        Image is Non Interlaced.
        No Image Color Map.

GIF file terminated normally.

$ cat colourmap.txt
  0 188 189 196
  1 228 220 222
  2 243 238 238
  3 249 248 246
  4 251 252 252
etc....

$ gifclrmp -g 2.2  <wapen_merksem.gif >coulourmap
Generates image with lighter tones
$ file coulourmap
coulourmap: GIF image data, version 87a, 50 x 60
$ gif2rgb -c 8 -o rgbtest wapen_merksem.gif
Generates 3 binary files
All OK.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Comment 5 Thomas Andrews 2025-04-12 01:20:58 CEST
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

katnatek 2025-04-12 19:59:43 CEST

Keywords: (none) => advisory

Comment 6 Mageia Robot 2025-04-12 21:05:00 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0135.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.