CVE-2015-7506: 
Linux Debian vulnerability analysis and mitigation

The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted LZW stream in a GIF file (Openwall Mailing List, NVD).

The vulnerability occurs when 'set_code_size' is 0xc, causing 'clear_code' to be assigned a value of 4096. The while-loop in 'gif_next_LZW()' executes as long as 'code >= clear_code', which can lead to an out-of-bounds read when 'code' is used to dereference 'table' (2d array * 4096). Although a boundary check exists for 'code >= max_code', the result may still exceed 'max_code' due to the bookkeeping of the original value. Testing demonstrated out-of-bounds reads with code values of 6670 and 7999 (Openwall Mailing List).

The vulnerability can result in denial of service through application crashes and potential information disclosure through out-of-bounds memory reads when processing specially crafted GIF files (NVD).

The vulnerability has been fixed in the git HEAD version of libnsgif. Users should upgrade to the patched version (Openwall Mailing List).