Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2011-2896

Published: 19 August 2011

The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

Priority

Medium

Status

Package Release Status
cups
Launchpad, Ubuntu, Debian
artful Not vulnerable
(1.5.0-5)
bionic Not vulnerable
(1.5.0-5)
cosmic Not vulnerable
(1.5.0-5)
disco Not vulnerable
(1.5.0-5)
eoan Not vulnerable
(1.5.0-5)
focal Not vulnerable
(1.5.0-5)
groovy Not vulnerable
(1.5.0-5)
hardy Does not exist

hirsute Not vulnerable
(1.5.0-5)
impish Not vulnerable
(1.5.0-5)
jammy Not vulnerable
(1.5.0-5)
kinetic Not vulnerable
(1.5.0-5)
lucid
Released (1.4.3-1ubuntu1.5)
maverick
Released (1.4.4-6ubuntu2.4)
natty
Released (1.4.6-5ubuntu1.4)
oneiric Not vulnerable
(1.5.0-5)
precise Does not exist
(precise was not-affected [1.5.0-5])
quantal Not vulnerable
(1.5.0-5)
raring Not vulnerable
(1.5.0-5)
saucy Not vulnerable
(1.5.0-5)
trusty Does not exist
(trusty was not-affected [1.5.0-5])
upstream
Released (1.4.7)
utopic Not vulnerable
(1.5.0-5)
vivid Not vulnerable
(1.5.0-5)
wily Not vulnerable
(1.5.0-5)
xenial Not vulnerable
(1.5.0-5)
yakkety Not vulnerable
(1.5.0-5)
zesty Not vulnerable
(1.5.0-5)
Patches:
upstream: https://github.com/apple/cups/commit/771bd8cbffe1ffb06d90b2c7f00191830e6b738c



cupsys
Launchpad, Ubuntu, Debian
artful Does not exist

bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hardy
Released (1.3.7-1ubuntu3.13)
hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

lucid Does not exist

maverick Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream Needs triage

utopic Does not exist

vivid Does not exist

wily Does not exist

xenial Does not exist

yakkety Does not exist

zesty Does not exist

gimp
Launchpad, Ubuntu, Debian
artful Not vulnerable
(2.6.11-2ubuntu4)
bionic Not vulnerable
(2.6.11-2ubuntu4)
cosmic Not vulnerable
(2.6.11-2ubuntu4)
disco Not vulnerable
(2.6.11-2ubuntu4)
eoan Not vulnerable
(2.6.11-2ubuntu4)
focal Not vulnerable
(2.6.11-2ubuntu4)
groovy Not vulnerable
(2.6.11-2ubuntu4)
hardy Ignored
(reached end-of-life)
hirsute Not vulnerable
(2.6.11-2ubuntu4)
impish Not vulnerable
(2.6.11-2ubuntu4)
jammy Not vulnerable
(2.6.11-2ubuntu4)
kinetic Not vulnerable
(2.6.11-2ubuntu4)
lucid
Released (2.6.8-2ubuntu1.4)
maverick
Released (2.6.10-1ubuntu3.4)
natty
Released (2.6.11-1ubuntu6.2)
oneiric
Released (2.6.11-2ubuntu4)
precise Does not exist
(precise was not-affected [2.6.11-2ubuntu4])
quantal Not vulnerable
(2.6.11-2ubuntu4)
raring Not vulnerable
(2.6.11-2ubuntu4)
saucy Not vulnerable
(2.6.11-2ubuntu4)
trusty Does not exist
(trusty was not-affected [2.6.11-2ubuntu4])
upstream Needs triage

utopic Not vulnerable
(2.6.11-2ubuntu4)
vivid Not vulnerable
(2.6.11-2ubuntu4)
wily Not vulnerable
(2.6.11-2ubuntu4)
xenial Not vulnerable
(2.6.11-2ubuntu4)
yakkety Not vulnerable
(2.6.11-2ubuntu4)
zesty Not vulnerable
(2.6.11-2ubuntu4)
Patches:

upstream: http://git.gnome.org/browse/gimp/commit/?id=376ad788c1a1c31d40f18494889c383f6909ebfc
upstream: http://git.gnome.org/browse/gimp/commit/?id=b1a3de761362db982c0ddfaff60ab4a3c4267f32 (related)

swi-prolog
Launchpad, Ubuntu, Debian
artful Ignored
(reached end-of-life)
bionic Needed

cosmic Ignored
(reached end-of-life)
disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needed

groovy Ignored
(reached end-of-life)
hardy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needed

kinetic Needed

lucid Ignored
(reached end-of-life)
maverick Ignored
(reached end-of-life)
natty Ignored
(reached end-of-life)
oneiric Ignored
(reached end-of-life)
precise Does not exist
(precise was needed)
quantal Ignored
(reached end-of-life)
raring Ignored
(reached end-of-life)
saucy Ignored
(reached end-of-life)
trusty Does not exist
(trusty was needed)
upstream Needs triage

utopic Ignored
(reached end-of-life)
vivid Ignored
(reached end-of-life)
wily Ignored
(reached end-of-life)
xenial Needed

yakkety Ignored
(reached end-of-life)
zesty Ignored
(reached end-of-life)
Patches:



upstream: http://www.swi-prolog.org/git/packages/xpce.git/commit/bb328029beb148691edc031d9db9cf0a503c8247