CVE catalog

CVE-2023-43907

optipng: CVE-2023-43907

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	optipng	sid	`7.9.1+ds-2`	fixed
Debian	optipng	forky	`7.9.1+ds-2`	fixed
Debian	optipng	trixie	`0.7.8+ds-1`	fixed
Debian	optipng	bookworm	`0.7.7-2`	vulnerable
Opensuse	optipng	tumbleweed	`0.7.8-1.1`	fixed
Ubuntu	optipng	16.04	`0.7.5-1`	vulnerable
Ubuntu	optipng	16.04	`0.7.6-1`	vulnerable
Ubuntu	optipng	16.04	`0.7.6-1ubuntu0.16.04.1`	vulnerable
Ubuntu	optipng	18.04	`0.7.6-1build1`	vulnerable
Ubuntu	optipng	18.04	`0.7.6-1ubuntu1`	vulnerable
Ubuntu	optipng	18.04	`0.7.6-1.1`	vulnerable
Ubuntu	optipng	20.04	`0.7.7-1`	vulnerable
Ubuntu	optipng	22.04	`0.7.7-1build1`	vulnerable
Ubuntu	optipng	22.04	`0.7.7-2`	vulnerable
Ubuntu	optipng	22.04	`0.7.7-2build1`	vulnerable
Suse	optipng	package hub 15 sp4	`0.7.8-bp154.3.5.1`	fixed
Opensuse	optipng	leap 15.4	`0.7.8-bp154.3.5.1`	fixed

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	optipng	source	sid	`0.7.8+ds-1`	unimportant	Not reported	[1055668]
Debian	optipng	source	forky	`0.7.8+ds-1`	unimportant	Not reported	[1055668]
Debian	optipng	source	trixie	`0.7.8+ds-1`	unimportant	Not reported	[1055668]
Debian	optipng	source	bookworm	`(unfixed)`	unimportant	Not reported	[1055668]
Opensuse	optipng	rpm	tumbleweed	`0.7.8-1.1`	Not reported	OPENSUSE-SU-2024:13415-1	Not reported
Suse	optipng	rpm	package hub 15 sp4	`0.7.8-bp154.3.5.1`	Not reported	OPENSUSE-SU-2023:0388-1	Not reported
Opensuse	optipng	rpm	leap 15.4	`0.7.8-bp154.3.5.1`	Not reported	OPENSUSE-SU-2023:0388-1	Not reported

Matching against OpenFactory catalog package versions is in progress.