CVE-2019-16346

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-16346
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16346.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-16346
Published
2019-09-16T13:15:11.823Z
Modified
2025-11-20T10:58:30.866447Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

ngiflib 0.4 has a heap-based buffer overflow in WritePixel() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.

References

Affected packages

Git / github.com/miniupnp/ngiflib

Affected ranges

Type
GIT
Repo
https://github.com/miniupnp/ngiflib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
37d939a6f511d16d4c95678025c235fe62e6417a

Affected versions

0.*

0.1
0.2
0.4

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "source": "https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "237808059705286189303728704739888498370",
                "229242860648037405396880656468698488460",
                "124731630603682325519766367357309372658",
                "328624310187704045354111804685906575459",
                "268124930057869837187129210907045579643",
                "31023134387890228903570843735593166343",
                "193339466565163149689761784093763144872",
                "297498800914596575828030126404514455487",
                "5601185720343475656114657374560486875",
                "178267510075713463348512151448395775435",
                "321398342015279822042128630076841080835",
                "26560040010434068325631006412338067695",
                "106133190357796406044542665402384918400",
                "168115372304991335718461962051690690734",
                "91976863540595785612362940767559846201",
                "118626459655440337298746134586675295327",
                "59296448183950155605115959862582734659",
                "338727352457999736121563534813910053803",
                "116091655869708970700611955148013661270",
                "241313923583721798498167393239016259905",
                "120365708482770233787837790524979671985",
                "131053759489204788757460821821315826691",
                "319741250024963548175128897504153706373",
                "18324846332395770525032013630325475653",
                "158283433243319755807916970051652500413",
                "131937554007643913125836620921660157663",
                "231344623515658086528864884266885993654",
                "210828881339791191729507079824018751028",
                "322707758521564882711322399228719005820",
                "328624310187704045354111804685906575459",
                "268124930057869837187129210907045579643",
                "31023134387890228903570843735593166343",
                "193339466565163149689761784093763144872",
                "297498800914596575828030126404514455487",
                "5601185720343475656114657374560486875",
                "178267510075713463348512151448395775435",
                "321398342015279822042128630076841080835",
                "26560040010434068325631006412338067695",
                "106133190357796406044542665402384918400",
                "168115372304991335718461962051690690734",
                "91976863540595785612362940767559846201",
                "118626459655440337298746134586675295327",
                "59296448183950155605115959862582734659",
                "338727352457999736121563534813910053803",
                "116091655869708970700611955148013661270",
                "241313923583721798498167393239016259905",
                "120365708482770233787837790524979671985",
                "131053759489204788757460821821315826691",
                "319741250024963548175128897504153706373",
                "18324846332395770525032013630325475653",
                "158283433243319755807916970051652500413",
                "131937554007643913125836620921660157663",
                "231344623515658086528864884266885993654",
                "210828881339791191729507079824018751028",
                "322707758521564882711322399228719005820"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2019-16346-9688e601",
        "target": {
            "file": "ngiflib.c"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a",
        "deprecated": false,
        "digest": {
            "length": 2913.0,
            "function_hash": "299598310729035935313140039135422048081"
        },
        "signature_type": "Function",
        "id": "CVE-2019-16346-f72aab64",
        "target": {
            "function": "WritePixels",
            "file": "ngiflib.c"
        }
    },
    {
        "signature_version": "v1",
        "source": "https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a",
        "deprecated": false,
        "digest": {
            "length": 2316.0,
            "function_hash": "60390860885510470224584324540478048947"
        },
        "signature_type": "Function",
        "id": "CVE-2019-16346-fce35e71",
        "target": {
            "function": "WritePixel",
            "file": "ngiflib.c"
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16346.json"