gif2png contains a flaw in the handling of Graphics Interchange Format (GIF) media files that may allow a remote denial of service. The issue is due to an error within gif2png.c not validating user-supplied input. With a specially crafted request containing many images, a context-dependent attacker can cause the program that uses the library to crash.

Currently, there are no known workarounds or vendor upgrades to correct this issue. However, multiple Linux distributions have released a patch to address this vulnerability. Check the related advisories, changelogs, or solutions in the references section for details.

As with all third-party solutions, ensure they come from a reliable source and are permitted under your company's security policy.

• CVE ID: 2010-4694 (see also: NVD)
• Secunia Advisory ID: 42796 48437
• Bugtraq ID: 45815
• ISS X-Force ID: 64754
• VUPEN Advisory: ADV-2010-3036 ADV-2011-0023 ADV-2011-0107
• Vendor Specific News/Changelog Entry: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550978
  http://bugs.gentoo.org/show_bug.cgi?id=346501
  http://cvs.fedoraproject.org/viewvc/rpms/gif2png/devel/gif2png-overflow.patch?revision=HEAD&root=extras&view=markup
  http://cvs.fedoraproject.org/viewvc/rpms/gif2png/devel/gif2png-overflow.patch?root=extras&view=log
  http://www.gentoo.org/security/en/glsa/glsa-201203-15.xml
  https://bugzilla.redhat.com/show_bug.cgi?id=547515
• Mail List Post: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051229.html
• Other Advisory URL: http://openwall.com/lists/oss-security/2010/11/21/1
  http://openwall.com/lists/oss-security/2010/11/22/1
  http://openwall.com/lists/oss-security/2010/11/22/12
  http://openwall.com/lists/oss-security/2010/11/22/3
  http://www.mandriva.com/security/advisories?name=MDVSA-2011:009
• Vendor Specific Solution URL: http://security.gentoo.org/glsa/glsa-201101-01.xml
• Vendor URL: http://www.catb.org/esr/gif2png/

• Patroklos Argyroudis