CVE-2019-11932: android-gif-drawable Double Free vulnerability
(updated )
A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.
References
- awakened1712.github.io/hacking/hacking-whatsapp-gif-rce
- gist.github.com/wdormann/874198c1bd29c7dd2157d9fc1d858263
- github.com/advisories/GHSA-x534-j49x-mqvj
- github.com/koral--/android-gif-drawable
- github.com/koral--/android-gif-drawable/commit/cc5b4f8e43463995a84efd594f89a21f906c2d20
- github.com/koral--/android-gif-drawable/pull/673
- github.com/koral--/android-gif-drawable/pull/673/commits/4944c92761e0a14f04868cbcf4f4e86fd4b7a4a9
- nvd.nist.gov/vuln/detail/CVE-2019-11932
- www.facebook.com/security/advisories/cve-2019-11932
Code Behaviors & Features
Detect and mitigate CVE-2019-11932 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →