openEuler giflib Heap-Based Buffer Overflow Vulnerability

A heap-based buffer overflow vulnerability has been identified in the openEuler giflib package, specifically in version 5.2.2 and earlier. The issue arises in the 'gif2rgb' program, where the 'DumpScreen2RGB' function improperly accesses the color map. This out-of-bounds access leads to a heap buffer overflow.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can potentially be exploited to execute arbitrary code.

Reproduction

The vulnerability can be reproduced by compiling the giflib package with AddressSanitizer enabled, and then using the gif2rgb command to process a crafted GIF file that exploits the buffer overflow.

Remediation

Users can update to the latest version of giflib, where this vulnerability has been fixed. Instructions for updating can be found in the openEuler documentation.