PT-2004-3718 · Gd+1 · Gd-Devel+6

Published 1970-01-01 · Updated 2018-05-03 · CVE-2004-0941

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libgd versions 2.0.21 and earlier gd-devel versions 1.8.4 and earlier gd-progs versions 1.8.4 and earlier libgd1-noxpm versions 1.8.4 and earlier libgd1 versions 1.8.4 and earlier gd versions 1.8.4 and earlier

Description The issue is related to multiple buffer overflows in the gd graphics library, which may allow remote attackers to execute arbitrary code via malformed image files. This is due to improper calls to the gdMalloc function. The vulnerability can be exploited remotely and may lead to disruption of confidentiality, integrity, and availability of protected information.

Recommendations For libgd versions 2.0.21 and earlier, update to a version later than 2.0.21 to resolve the issue. For gd-devel versions 1.8.4 and earlier, update to a version later than 1.8.4 to resolve the issue. For gd-progs versions 1.8.4 and earlier, update to a version later than 1.8.4 to resolve the issue. For libgd1-noxpm versions 1.8.4 and earlier, update to a version later than 1.8.4 to resolve the issue. For libgd1 versions 1.8.4 and earlier, update to a version later than 1.8.4 to resolve the issue. For gd versions 1.8.4 and earlier, update to a version later than 1.8.4 to resolve the issue. As a temporary workaround, consider restricting access to the gdMalloc function until a patch is available.

Fix

Related Identifiers

BDU:2015-03349

BDU:2015-03350

BDU:2015-06180

BDU:2015-06181

BDU:2015-06182

CVE-2004-0941

DSA-601-1

DSA-602-1

RHSA-2004:638

RHSA-2006:0194

RHSA-2006_0194

Affected Products

Red Hat

Gd

Gd-Devel

Gd-Progs

Libgd

Libgd1

Libgd1-Noxpm

References · 33

• http://trustix.org/errata/2004/0058 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06180 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2004-0941 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:113 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0941 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06181 · Security Note
• http://redhat.com/support/errata/RHSA-2006-0194.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03349 · Security Note
• http://debian.org/security/2004/dsa-601 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-638.html · Vendor Advisory
• http://securityfocus.com/bid/11663 · Vendor Advisory
• https://ubuntu.com/usn/usn-33-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0941 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:122 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0990 · Security Note