PT-2007-1096 · Libgd · Gd Graphics Library

Published 2007-06-28 · Updated 2018-10-16 · CVE-2007-3478

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: GD Graphics Library (libgd) versions prior to 2.0.35

Description: The issue is related to a race condition in the gdImageStringFTEx function, specifically in the gdft draw bitmap part of the gdft.c file. This could allow remote attackers to cause a denial of service, potentially by exploiting the library's support for truetype font (TTF) files. Multiple vulnerabilities in the GD Graphics Library package before version 2.0.35 may lead to disruptions in the availability of protected information, and these vulnerabilities can be exploited remotely.

Recommendations: For versions prior to 2.0.35, update to version 2.0.35 or later to resolve the issue. As a temporary workaround, consider restricting the use of truetype font (TTF) support until a patch is applied.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2015-09579

CVE-2007-3478

Affected Products

Gd Graphics Library

References · 36

• https://nvd.nist.gov/vuln/detail/CVE-2007-3478 · Security Note
• http://security.gentoo.org/glsa/glsa-200805-13.xml · Vendor Advisory
• http://fedoranews.org/updates/FEDORA-2007-205.shtml · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200711-34.xml · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200708-05.xml · Vendor Advisory
• http://trustix.org/errata/2007/0024 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:164 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-3478 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-3478 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_15_sr.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.html · Vendor Advisory
• http://secunia.com/advisories/25855 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052854.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09579 · Security Note
• http://redhat.com/archives/fedora-package-announce/2007-September/msg00311.html · Vendor Advisory