CVE-2017-20286Published
DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2017-20286 · Microsoft / collected KEV context
cve-program · CVE-2017-20286
- https://github.com/DentonW/DevIL/issues/67
- https://hackmd.io/@haind-pwn/devil-gif-palette-reuse-heap-overflow
- https://github.com/DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L189-L226
- https://github.com/DentonW/DevIL/blob/a2d9193fed0c7f93519c0c4c28b3348e0cb5759b/DevIL/src-IL/src/il_gif.cpp#L314-L324
- https://www.vulncheck.com/advisories/devil-through-1.8.0-heap-buffer-overflow-via-gif-igetpalette
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.