View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2018-11490 severity important: SUSE including 265 source package names (10.1.33-openjdk11-59.4:libgif7-5.2.1-150000.4.8.1, 10.1.33-openjdk17-59.4:libgif7-5.2.1-150000.4.8.1, …), 336 product×package rows across 49 product lines (Container bci/openjdk, Container bci/openjdk-devel, … (49 product lines)): Known Affected 231, Fixed 101, Known Not Affected 4.
The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.