ALAS2023-2025-1220

References: CVE-2023-48161  CVE-2024-45993  CVE-2025-31344 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c (CVE-2023-48161)

Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb. (CVE-2024-45993)

NOTE: https://www.openwall.com/lists/oss-security/2025/04/07/3
NOTE: https://sourceforge.net/p/giflib/bugs/176/ (CVE-2025-31344)

Issue Correction:
Run dnf update giflib --releasever 2023.9.20251014 or dnf update --advisory ALAS2023-2025-1220 --releasever 2023.9.20251014 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    giflib-debugsource-5.2.1-9.amzn2023.0.2.aarch64
    giflib-debuginfo-5.2.1-9.amzn2023.0.2.aarch64
    giflib-utils-5.2.1-9.amzn2023.0.2.aarch64
    giflib-5.2.1-9.amzn2023.0.2.aarch64
    giflib-utils-debuginfo-5.2.1-9.amzn2023.0.2.aarch64
    giflib-devel-5.2.1-9.amzn2023.0.2.aarch64

src:
    giflib-5.2.1-9.amzn2023.0.2.src

x86_64:
    giflib-debugsource-5.2.1-9.amzn2023.0.2.x86_64
    giflib-debuginfo-5.2.1-9.amzn2023.0.2.x86_64
    giflib-devel-5.2.1-9.amzn2023.0.2.x86_64
    giflib-utils-debuginfo-5.2.1-9.amzn2023.0.2.x86_64
    giflib-5.2.1-9.amzn2023.0.2.x86_64
    giflib-utils-5.2.1-9.amzn2023.0.2.x86_64