CVE-2022-1507

MEDIUM

chafa < 1.10.2 - Denial of Service via NULL Pointer Dereference in gif_internal_decode_frame

Title source: llm

Description

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file.

References (5)

Core 5

Core References

Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

https://huntr.dev/bounties/104d8c5d-cac5-4baa-9ac9-291ea0bcab95

Patch, Third Party Advisory x_refsource_misc

https://github.com/hpjansson/chafa/commit/e4b777c7b7c144cd16a0ea96108267b1004fe6c9

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L54UEP5S254VP5FZWGFPHLTPMFJVOGYT/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIOAZPITFL2Y7Y6KHCZ4OIK7P7KWFN22/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PLHKTQYK6AO3M5NAVM3CDVQTZZS6MCO/

Scores

CVSS v3 5.5

EPSS 0.0032

EPSS Percentile 54.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE

CWE-476

Status published

Products (4)

chafa_project/chafa < 1.10.2

fedoraproject/fedora 34

fedoraproject/fedora 35

fedoraproject/fedora 36

Published Apr 27, 2022

Tracked Since Feb 18, 2026