VDB
CVE-2011-2896
CVE-2011-2896
PUBLISHED
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.
EPSS 7.22% · 91.8th percentile
Risk Scores
EPSS Score
7.22%
91.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | swi-prolog | 7.2.0-2, 7.2.3-2, 7.2.0-3 |
| Ubuntu:22.04:LTS | swi-prolog | 8.2.4+dfsg-1ubuntu1, 8.4.2+dfsg-2ubuntu1, 0 |
| Ubuntu:25.10 | swi-prolog | 9.2.9+dfsg-1, 0, * |
| Ubuntu:18.04:LTS | swi-prolog | 7.6.4+dfsg-1build1, 7.4.2+dfsg-2, 7.6.1+dfsg-3 |
| Ubuntu:20.04:LTS | swi-prolog | 0, 7.6.4+dfsg-2ubuntu2 |
| Ubuntu:24.04:LTS | swi-prolog | 9.0.4+dfsg-3.1ubuntu4, 9.0.4+dfsg-3ubuntu1, 9.0.4+dfsg-2ubuntu1 |
Exploit Intelligence
- DSA-2426 (circl)
- FEDORA-2011-11318 (circl)
- GLSA-201209-23 (circl)
- http://cups.org/str.php?L3867 (circl)
- [oss-security] 20110810 LZW decompression issues (circl)
- USN-1207-1 (circl)
- https://bugzilla.redhat.com/show_bug.cgi?id=727800 (circl)
- RHSA-2012:1180 (circl)
- 48308 (circl)
- DSA-2354 (circl)
…and 22 more exploits
Timeline
- Aug 15, 2011 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 3, 2023 EPSS Score
- Feb 13, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
- Oct 30, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2011-2896 third-party-advisory
- https://ubuntu.com/security/notices/USN-1207-1 vendor-advisory
- https://ubuntu.com/security/notices/USN-1214-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2011-2896 third-party-advisory