CVE catalog

CVE-2016-3977

giflib: CVE-2016-3977

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.10% · Oct 25, 2026

Heap-based buffer overflow in util/gif2rgb.c in gif2rgb in giflib 5.1.2 allows remote attackers to cause a denial of service (application crash) via the background color index in a GIF file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangiflibsid6.1.3-1fixed
Debiangiflibforky6.1.3-1fixed
Debiangiflibtrixie5.2.2-1+deb13u1fixed
Debiangiflibbookworm5.2.1-2.5+deb12u1fixed
Alpinegiflib3.45.1.4-r0fixed
Ubuntugiflib18.045.1.4-1vulnerable
Ubuntugiflib18.045.1.4-2vulnerable
Ubuntugiflib18.045.1.4-2ubuntu0.1fixed
Ubuntugiflib16.044.1.6-11vulnerable
Ubuntugiflib16.045.1.1-0ubuntu1vulnerable
Ubuntugiflib16.045.1.1-0.1vulnerable
Ubuntugiflib16.045.1.1-0.2vulnerable
Ubuntugiflib16.045.1.2-0.1vulnerable
Ubuntugiflib16.045.1.2-0.2vulnerable
Ubuntugiflib16.045.1.4-0.3~16.04vulnerable
Ubuntugiflib16.045.1.4-0.3~16.04.1fixed
Ubuntugiflib18.045.1.4-1vulnerable
Ubuntugiflib18.045.1.4-2vulnerable
Ubuntugiflib18.045.1.4-2ubuntu0.1fixed
Susegifliblinux enterprise module for basesystem 15 sp35.2.1-150000.4.8.1fixed
Susegifliblinux enterprise real time 15 sp25.2.1-150000.4.8.1fixed
Opensusegiflibleap 15.35.2.1-150000.4.8.1fixed
Opensusegiflibleap 15.45.2.1-150000.4.8.1fixed
Susegifliblinux enterprise desktop 125.0.5-12.1fixed
Susegifliblinux enterprise desktop 12 sp15.0.5-12.1fixed
Susegifliblinux enterprise software development kit 125.0.5-12.1fixed
Susegifliblinux enterprise software development kit 12 sp15.0.5-12.1fixed
Susegifliblinux enterprise server 125.0.5-12.1fixed
Susegifliblinux enterprise server for sap applications 125.0.5-12.1fixed
Susegifliblinux enterprise server 12 sp15.0.5-12.1fixed
Susegifliblinux enterprise server for sap applications 12 sp15.0.5-12.1fixed
Susegifliblinux enterprise high performance computing 15 sp1-ltss5.2.1-150000.4.8.1fixed
Susegifliblinux enterprise high performance computing 15 sp2-ltss5.2.1-150000.4.8.1fixed
Susegifliblinux enterprise server 15 sp1-ltss5.2.1-150000.4.8.1fixed
Susegifliblinux enterprise server 15 sp2-ltss5.2.1-150000.4.8.1fixed
Susegifliblinux enterprise server for sap applications 15 sp15.2.1-150000.4.8.1fixed
Susegifliblinux enterprise server for sap applications 15 sp25.2.1-150000.4.8.1fixed
Susegiflibenterprise storage 75.2.1-150000.4.8.1fixed
Susegifliblinux enterprise software development kit 11 sp44.1.6-21.1fixed
Susegifliblinux enterprise server 11 sp44.1.6-21.1fixed
Susegifliblinux enterprise server for sap applications 11 sp44.1.6-21.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangiflibsourcesid5.1.4-3not yet assignedNot reported[820526]
Debiangiflibsourceforky5.1.4-3not yet assignedNot reported[820526]
Debiangiflibsourcetrixie5.1.4-3not yet assignedNot reported[820526]
Debiangiflibsourcebookworm5.1.4-3not yet assignedNot reported[820526]
Alpinegiflibapk3.45.1.4-r0Not reportedALPINE-CVE-2016-3977Not reported
Ubuntugiflibdeb18.045.1.4-2ubuntu0.1Not reportedUBUNTU-CVE-2016-3977Not reported
Ubuntugiflibdeb16.045.1.4-0.3~16.04.1Not reportedUSN-4107-1Not reported
Ubuntugiflibdeb18.045.1.4-2ubuntu0.1Not reportedUSN-4107-1Not reported
Susegiflibrpmlinux enterprise module for basesystem 15 sp35.2.1-150000.4.8.1Not reportedSUSE-SU-2022:1565-1Not reported
Susegiflibrpmlinux enterprise real time 15 sp25.2.1-150000.4.8.1Not reportedSUSE-SU-2022:1565-1Not reported
Opensusegiflibrpmleap 15.35.2.1-150000.4.8.1Not reportedSUSE-SU-2022:1565-1Not reported
Opensusegiflibrpmleap 15.45.2.1-150000.4.8.1Not reportedSUSE-SU-2022:1565-1Not reported
Susegiflibrpmlinux enterprise desktop 125.0.5-12.1Not reportedSUSE-SU-2016:1140-1Not reported
Susegiflibrpmlinux enterprise desktop 12 sp15.0.5-12.1Not reportedSUSE-SU-2016:1140-1Not reported
Susegiflibrpmlinux enterprise software development kit 125.0.5-12.1Not reportedSUSE-SU-2016:1140-1Not reported
Susegiflibrpmlinux enterprise software development kit 12 sp15.0.5-12.1Not reportedSUSE-SU-2016:1140-1Not reported
Susegiflibrpmlinux enterprise server 125.0.5-12.1Not reportedSUSE-SU-2016:1140-1Not reported
Susegiflibrpmlinux enterprise server for sap applications 125.0.5-12.1Not reportedSUSE-SU-2016:1140-1Not reported
Susegiflibrpmlinux enterprise server 12 sp15.0.5-12.1Not reportedSUSE-SU-2016:1140-1Not reported
Susegiflibrpmlinux enterprise server for sap applications 12 sp15.0.5-12.1Not reportedSUSE-SU-2016:1140-1Not reported
Susegiflibrpmlinux enterprise high performance computing 15 sp1-ltss5.2.1-150000.4.8.1Not reportedSUSE-SU-2023:1970-2Not reported
Susegiflibrpmlinux enterprise high performance computing 15 sp2-ltss5.2.1-150000.4.8.1Not reportedSUSE-SU-2023:1970-2Not reported
Susegiflibrpmlinux enterprise server 15 sp1-ltss5.2.1-150000.4.8.1Not reportedSUSE-SU-2023:1970-2Not reported
Susegiflibrpmlinux enterprise server 15 sp2-ltss5.2.1-150000.4.8.1Not reportedSUSE-SU-2023:1970-2Not reported
Susegiflibrpmlinux enterprise server for sap applications 15 sp15.2.1-150000.4.8.1Not reportedSUSE-SU-2023:1970-2Not reported
Susegiflibrpmlinux enterprise server for sap applications 15 sp25.2.1-150000.4.8.1Not reportedSUSE-SU-2023:1970-2Not reported
Susegiflibrpmenterprise storage 75.2.1-150000.4.8.1Not reportedSUSE-SU-2023:1970-2Not reported
Susegiflibrpmlinux enterprise software development kit 11 sp44.1.6-21.1Not reportedSUSE-SU-2016:1139-1Not reported
Susegiflibrpmlinux enterprise server 11 sp44.1.6-21.1Not reportedSUSE-SU-2016:1139-1Not reported
Susegiflibrpmlinux enterprise server for sap applications 11 sp44.1.6-21.1Not reportedSUSE-SU-2016:1139-1Not reported

[Debian bug #820526]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [giflib-tools]Fixed

    Source package: [giflib]

    Details (2)

    • 5.2.1-2.5+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · bookworm; dsa · giflib · debian · 12

    • 5.2.1-2.5+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · bookworm; dsa · giflib · debian · 12

  • [libgif7]Fixed

    Source package: [giflib]

    Details (2)

    • 5.2.1-2.5+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · bookworm; dsa · giflib · debian · 12

    • 5.2.1-2.5+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · bookworm; dsa · giflib · debian · 12

  • [libgif-dev]Fixed

    Source package: [giflib]

    Details (2)

    • 5.2.1-2.5+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · bookworm; dsa · giflib · debian · 12

    • 5.2.1-2.5+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · bookworm; dsa · giflib · debian · 12

[Debian 13 (Trixie)]

  • [giflib-tools]Fixed

    Source package: [giflib]

    Details (2)

    • 5.2.2-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · 13

    • 5.2.2-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · 13

  • [libgif7]Fixed

    Source package: [giflib]

    Details (2)

    • 5.2.2-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · 13

    • 5.2.2-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · 13

  • [libgif-dev]Fixed

    Source package: [giflib]

    Details (2)

    • 5.2.2-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · 13

    • 5.2.2-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 5.1.4-3

      dsa · giflib · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]