CVE-2011-2896 The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadB...
MediumCVSS 5.1
EPSS 12.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/swi-prolog(Ubuntu:22.04) | All versions | No fix listed |
| debian/cups(Debian:12) | < 1.5.0-8 | 1.5.0-8 |
| debian/cups(Debian:13) | < 1.5.0-8 | 1.5.0-8 |
| debian/cups(Debian:14) | < 1.5.0-8 | 1.5.0-8 |
| debian/gimp(Debian:12) | < 2.6.11-5 | 2.6.11-5 |
| debian/gimp(Debian:13) | < 2.6.11-5 | 2.6.11-5 |
| debian/gimp(Debian:14) | < 2.6.11-5 | 2.6.11-5 |
| swi-prolog | <= 5.10.4 | No fix listed |
| apple cups | <= 1.4.6 | No fix listed |
| gimp | <= 2.6.11 | No fix listed |
| ubuntu/swi-prolog(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/swi-prolog(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/swi-prolog(Ubuntu:26.10) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-1207-1 vendor-advisory
- USN-1214-1 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2011-2896 vendor-advisory
- cups.org patch third-party-advisory
- git.gnome.org patch vendor-advisory
- FEDORA-2011-11197 third-party-advisory vendor-advisory
- FEDORA-2011-11173 third-party-advisory vendor-advisory
- FEDORA-2011-11305 third-party-advisory vendor-advisory
- FEDORA-2011-11318 third-party-advisory vendor-advisory
- FEDORA-2011-11221 third-party-advisory vendor-advisory
- FEDORA-2011-11229 third-party-advisory vendor-advisory
- RHSA-2012:1180 third-party-advisory vendor-advisory
- RHSA-2012:1181 third-party-advisory vendor-advisory
- 45621 broken-link third-party-advisory
- 45900 broken-link third-party-advisory
- 45945 broken-link third-party-advisory
- 45948 broken-link third-party-advisory
- 46024 broken-link third-party-advisory
- 48236 broken-link third-party-advisory
- 48308 broken-link third-party-advisory
- 50737 broken-link third-party-advisory
- GLSA-201209-23 third-party-advisory vendor-advisory
- DSA-2354 third-party-advisory vendor-advisory
- DSA-2426 third-party-advisory vendor-advisory
- MDVSA-2011:146 broken-link vendor-advisory
- MDVSA-2011:167 broken-link vendor-advisory
- [oss-security] 20110810 LZW decompression issues mailing-list patch third-party-advisory
- RHSA-2011:1635 broken-link vendor-advisory
- 49148 broken-link third-party-advisory vdb-entry
- 1025929 broken-link third-party-advisory vdb-entry
- www.swi-prolog.org issue-tracking third-party-advisory
- USN-1207-1 third-party-advisory vendor-advisory
- USN-1214-1 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- bugs.debian.org issue-tracking