Debian alert DLA-4650-1 (giflib)

From:
             
 
Tobias Frost <tobi@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4650-1] giflib security update
Date:
             
 
Fri, 26 Jun 2026 09:10:38 +0200
Message-ID:
             
 
<aj4l7pwvYE-_RyQX@isildor2.loewenhoehle.ip>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4650-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                         Tobias Frost
June 26, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : giflib
Version        : 5.1.9-2+deb11u1 $bookworm_VERSION
CVE ID         : CVE-2026-23868 CVE-2026-26740
Debian Bug     : 1130495 1131368

Two vulnerabilties have been found in giflib, a package of portable
tools and library routines for working with GIF images, potentially
allowing Denial of Service.

CVE-2026-23868

  Giflib contains a double-free vulnerability that is the result of a
  shallow copy in GifMakeSavedImage and incorrect error handling. The
  conditions needed to trigger this vulnerability are difficult but may
  be possible.

CVE-2026-26740

  A Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote
  attacker to cause a denial of service via the EGifGCBToExtension
  overwriting an existing Graphic Control Extension block without
  validating its allocated size.

For Debian 11 bullseye, these problems have been fixed in version
5.1.9-2+deb11u1.

We recommend that you upgrade your giflib packages.

For the detailed security status of giflib please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/giflib

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE/d0M/zhkJ3YwohhskWT6HRe9XTYFAmo+JekACgkQkWT6HRe9
XTbuBw/9F26eBVsL8l0ZHQvm4aKhs96MHQGPRspQdx7k1uFbmsBWuC9keoOzQU8t
D+oci55/hsDfZle8KYwV9sV0/b4+yNW5ZFjvKaczINF6Jl5/nEM/JzXAYMlhM61G
GjAJ7iugp+pGjTWzfrY/7uwx7DJDmNs7uAN0y4o4iK742ctx7D8FmFfeJitNTEM+
EAdXTgW+SkepquSAIFWktlsQ4ddSFXU1FiBiHjH3+gyGTmLMhBRZ4YvISba9p9vE
R4Y2pp54l5oKm33FYKoN1DMbaVLd9dDwFFvlvFPdDvYWKl3pelHzSN7zmdCV7xzy
/oGFB1SqyiGCyKvK+PC/LvDXd2sH9j/pew6itkVSV7TbU+yruiKxhnZ4UjO+OL0O
sXrQ8E/H0ObX40gGxVhPOE0Y/zjfrAQVKoY27n5Hb4zwqEaog6ookqwrhn1YX83n
4rg9oPhSImXiv/oFWW3w6OkzodIJ03UM02VRvu/d2bTe8CZRZoQRi65CMA5sL8xp
w9OgRDiXQSHy00OoqYvwD2LiJUO8EzEbPgYdEfne7RLUjgg9DLvHw+1I/Vi7kvoP
r5eHiXK2fxDDVijllylWkLFK5ltb/kmbUifWHamLNEa4Fn9XbesQ3hvcAYuXmHJB
IpbpCH+hsatNJICIFldiFMVqoqtmgFMN1K3t0+obVF/7eZQjGrg=
=RS/Y
-----END PGP SIGNATURE-----