vulnwire
7.8high

CVE-2017-20286

DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette

Published 23 d ago · modified 21 d ago · JSON

CVSS
7.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 10%
Public exploits
0
none known

DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
23 d ago

Exploit prediction (EPSS)

0.20% probability of exploitation in the next 30 days, higher than 10% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.08.5CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA4.08.5CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • DentonW DevIL

Classification

Weakness

References

  • github.com /DentonW/DevIL/issues/67 · issue-tracking
  • hackmd.io /@haind-pwn/devil-gif-palette-reuse-heap-overflow · third-party-advisory
  • github.com /DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L · technical-description
  • github.com /DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L · technical-description
  • vulncheck.com /advisories/devil-through-1.8.0-heap-buffer-overflow-via-gif-igetpalette · third-party-advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.