[GHSA-x534-j49x-mqvj] A double free vulnerability in the DDGifSlurp function in... #5162
Conversation
github-actions
bot
changed the base branch from
main
to
Marcono1234/advisory-improvement-5162
| "modified": "2023-03-01T18:30:58Z", | ||
| "modified": "2023-03-09T05:05:46Z", |
There was a problem hiding this comment.
Not sure why this modified value changed, and why it uses a date from 2023. I just copied this from #5161 where it was automatically changed like this.
| "details": "A double free vulnerability in the DDGifSlurp function in decoding.c in libpl_droidsonroids_gif before 1.2.15, as used in WhatsApp for Android before 2.19.244, allows remote attackers to execute arbitrary code or cause a denial of service.", | ||
| "summary": "Double free in android-gif-drawable", | ||
| "details": "A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.", |
There was a problem hiding this comment.
General question: Are changes from NVD not synced back here? According to https://nvd.nist.gov/vuln/detail/cve-2019-11932#VulnChangeHistorySection this change already happened in 2019.
(Though the NVD entry has some issues, it contains multiple duplicate reference links.)
| { | ||
| "package": { | ||
| "ecosystem": "Maven", | ||
| "name": "pl.droidsonroids.gif:android-gif-drawable" |
There was a problem hiding this comment.
Is this enough for Dependabot to notice this, and for it to be synced to https://osv.dev/vulnerability/CVE-2019-11932?
If not, could you please review this advisory so it goes from "unreviewed" to "github-reviewed"?
According to the presentation https://media.ccc.de/v/38c3-ultrawide-archaeology-on-android-native-libraries#t=1244 a lot of Android apps might still be using vulnerable versions.
Though maybe should be done together with #5164 then so users directly update to >= 1.2.24.
This is a copy of #5161 because I was unable to fix a typo there (see comment).
Updates
Comments
(this also corrects the fixed version to 1.2.18, see also https://github.com/koral--/android-gif-drawable/releases/tag/v1.2.18)