This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2017-20286 →

UBUNTU-CVE-2017-20286

DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buff...

Original description

The description as published by the source.

DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write beyond a 768-byte palette buffer when loading GIF images. Attackers can supply a crafted two-frame GIF whose second frame uses disposal method 1 with a local colour table, writing up to 384 controlled bytes past the heap allocation and possibly executing code.

Source: OSV.dev (Open Source Vulnerabilities) OSV