{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-31344", "assignerOrgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2", "state": "PUBLISHED", "assignerShortName": "openEuler", "dateReserved": "2025-03-28T07:29:55.637Z", "datePublished": "2025-04-14T07:49:36.597Z", "dateUpdated": "2025-04-14T13:39:00.299Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://gitee.com/src-openeuler", "defaultStatus": "unaffected", "packageName": "giflib", "platforms": ["Linux"], "product": "giflib", "programFiles": ["gif2rgb.c"], "repo": "https://gitee.com/src-openeuler/giflib", "vendor": "openEuler", "versions": [{"changes": [{"at": "2c10c1abf8ff2e88b1da04e050bb721487b73fa3", "status": "affected"}], "lessThanOrEqual": "5.2.2", "status": "affected", "version": "0", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jiaxuan Song(m202372152@hust.edu.cn)"}, {"lang": "en", "type": "finder", "value": "bale.cen (cenxianlong@huawei.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux.<p> This vulnerability is associated with program files <tt>gif2rgb.C</tt>.</p><p>This issue affects giflib: through 5.2.2.</p>"}], "value": "Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.\n\nThis issue affects giflib: through 5.2.2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2", "shortName": "openEuler", "dateUpdated": "2025-04-14T07:49:36.597Z"}, "references": [{"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1292"}, {"url": "https://gitee.com/src-openeuler/giflib/pulls/54"}], "source": {"discovery": "UNKNOWN"}, "title": "The giflib open-source component has a buffer overflow vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/04/07/3"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/07/4"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/07/5"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/07/6"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/08/1"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/09/5"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/09/7"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/10/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-04-14T08:05:04.085Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-14T13:36:32.164077Z", "id": "CVE-2025-31344", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T13:39:00.299Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/04/07/3"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/07/4"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/07/5"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/07/6"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/08/1"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/09/5"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/09/7"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/10/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-04-14T08:05:04.085Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-31344", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-14T13:36:32.164077Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T13:38:54.974Z"}}], "cna": {"title": "The giflib open-source component has a buffer overflow vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jiaxuan Song(m202372152@hust.edu.cn)"}, {"lang": "en", "type": "finder", "value": "bale.cen (cenxianlong@huawei.com)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitee.com/src-openeuler/giflib", "vendor": "openEuler", "product": "giflib", "versions": [{"status": "affected", "changes": [{"at": "2c10c1abf8ff2e88b1da04e050bb721487b73fa3", "status": "affected"}], "version": "0", "versionType": "git", "lessThanOrEqual": "5.2.2"}], "platforms": ["Linux"], "packageName": "giflib", "programFiles": ["gif2rgb.c"], "collectionURL": "https://gitee.com/src-openeuler", "defaultStatus": "unaffected"}], "references": [{"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1292"}, {"url": "https://gitee.com/src-openeuler/giflib/pulls/54"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.\n\nThis issue affects giflib: through 5.2.2.", "supportingMedia": [{"type": "text/html", "value": "Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux.<p> This vulnerability is associated with program files <tt>gif2rgb.C</tt>.</p><p>This issue affects giflib: through 5.2.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2", "shortName": "openEuler", "dateUpdated": "2025-04-14T07:49:36.597Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31344", "state": "PUBLISHED", "dateUpdated": "2025-04-14T13:39:00.299Z", "dateReserved": "2025-03-28T07:29:55.637Z", "assignerOrgId": "7e1ac599-2767-43fa-b3ea-f10178cc98f2", "datePublished": "2025-04-14T07:49:36.597Z", "assignerShortName": "openEuler"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.\n\nThis issue affects giflib: through 5.2.2."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de b\u00fafer en pila en giflib de openEuler en Linux. Esta vulnerabilidad est\u00e1 asociada a los archivos de programa gif2rgb.C. Este problema afecta a giflib: hasta la versi\u00f3n 5.2.2."}], "id": "CVE-2025-31344", "lastModified": "2025-04-15T18:39:27.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.7, "source": "securities@openeuler.org", "type": "Secondary"}]}, "published": "2025-04-14T08:15:13.973", "references": [{"source": "securities@openeuler.org", "url": "https://gitee.com/src-openeuler/giflib/pulls/54"}, {"source": "securities@openeuler.org", "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1292"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/04/07/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/04/07/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/04/07/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/04/07/6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/04/08/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/04/09/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/04/09/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/04/10/1"}], "sourceIdentifier": "securities@openeuler.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "securities@openeuler.org", "type": "Secondary"}]}

{"bugzilla": {"description": "giflib: The giflib open-source component has a buffer overflow vulnerability", "id": "2359418", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359418"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-122", "details": ["A flaw was found in the gif2rgb utility of giflib. This vulnerability allows an attacker to cause a heap-based buffer overflow via crafted GIF files. The issue arises due to improper handling of certain GIF image data, leading to memory corruption.\u200b"], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-31344", "package_state": [{"cpe": "cpe:/a:redhat:openjdk:11", "fix_state": "Fix deferred", "package_name": "java-11-openjdk-portable", "product_name": "Red Hat build of OpenJDK 11"}, {"cpe": "cpe:/a:redhat:openjdk:17", "fix_state": "Fix deferred", "package_name": "java-17-openjdk-portable", "product_name": "Red Hat build of OpenJDK 17"}, {"cpe": "cpe:/a:redhat:openjdk:1.8", "fix_state": "Fix deferred", "package_name": "java-1.8.0-openjdk-portable", "product_name": "Red Hat build of OpenJDK 1.8"}, {"cpe": "cpe:/a:redhat:openjdk:21", "fix_state": "Fix deferred", "package_name": "java-21-openjdk-portable-rhel7", "product_name": "Red Hat build of OpenJDK 21"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "giflib", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "giflib", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "giflib", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "giflib", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "java-17-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "java-1.8.0-openjdk", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "java-21-openjdk", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-14T07:49:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-31344\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-31344\nhttps://gitee.com/src-openeuler/giflib/pulls/54\nhttps://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1292"], "threat_severity": "Moderate"}