CVE-2023-44821

{"id": "CVE-2023-44821", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2023-10-09T20:15:10.583", "references": [{"url": "https://github.com/kohler/gifsicle/issues/195", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/kohler/gifsicle/issues/65", "tags": ["Exploit", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5/", "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF/", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory consumption). NOTE: this has been disputed by multiple parties because the Gifsicle code is not commonly used for unattended operation in which new input arrives for a long-running process, does not ship with functionality to link it into another application as a library, and does not have realistic use cases in which an adversary controls the entire command line."}, {"lang": "es", "value": "** EN DISPUTA ** Gifsicle hasta 1.94, si se implementa de una manera que permita que entradas no confiables afecten las llamadas de Gif_Realloc, podr\u00eda permitir una denegaci\u00f3n de servicio (consumo de memoria). NOTA: esto ha sido cuestionado por varias partes porque el c\u00f3digo Gifsicle no se usa com\u00fanmente para operaciones desatendidas en las que llegan nuevas entradas para un proceso de larga duraci\u00f3n, no incluye funcionalidad para vincularlo a otra aplicaci\u00f3n como una librer\u00eda y no tener casos de uso realistas en los que un adversario controla toda la l\u00ednea de comando."}], "lastModified": "2024-04-11T01:21:53.287", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lcdf:gifsicle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47014BE5-591F-41C7-ACC4-E77C24495169", "versionEndIncluding": "1.94"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}