PT-2007-7504 · Debian+2 · Libgd2-Noxpm-Dev+5

Published 1970-01-01 · Updated 2018-10-16 · CVE-2007-3476

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libgd2-xpm-dev (affected versions not specified) libgd2-noxpm (affected versions not specified) libgd2-noxpm-dev (affected versions not specified) libgd2-xpm (affected versions not specified) GD Graphics Library (libgd) versions prior to 2.0.35 gd (versions prior to 2.0.35)

Description The issue concerns multiple vulnerabilities in the libgd2-xpm-dev, libgd2-noxpm, libgd2-noxpm-dev, and libgd2-xpm packages of the Debian GNU/Linux operating system, as well as the GD Graphics Library (libgd) and the gd package of the Gentoo Linux operating system. These vulnerabilities can be exploited remotely, potentially leading to a disruption of confidentiality, integrity, and availability of protected information. Specifically, an array index error in the gd gif in.c file of the GD Graphics Library (libgd) before version 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, resulting in a segmentation fault.

Recommendations For libgd2-xpm-dev, consider updating to a version that includes the fix for this issue. For libgd2-noxpm, consider updating to a version that includes the fix for this issue. For libgd2-noxpm-dev, consider updating to a version that includes the fix for this issue. For libgd2-xpm, consider updating to a version that includes the fix for this issue. For GD Graphics Library (libgd) versions prior to 2.0.35, update to version 2.0.35 or later to resolve the issue. For gd versions prior to 2.0.35, update to version 2.0.35 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-03087

BDU:2015-03088

BDU:2015-03089

BDU:2015-03090

BDU:2015-09579

CVE-2007-3476

DSA-1613-1

ECHO-A7ED-BFEC-5FE3

RHSA-2008:0146

RHSA-2008_0146

Affected Products

Debian

Red Hat

Gd

Libgd2-Noxpm

Libgd2-Noxpm-Dev

Libgd2-Xpm

References · 50

• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052854.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-3476 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3996 · Security Note
• https://osv.dev/vulnerability/CVE-2007-3476 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03088 · Security Note
• http://security.gentoo.org/glsa/glsa-200711-34.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03087 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2445 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0146.html · Vendor Advisory
• http://trustix.org/errata/2007/0024 · Vendor Advisory
• http://fedoranews.org/updates/FEDORA-2007-205.shtml · Vendor Advisory
• http://libgd.org/ReleaseNote020035 · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052848.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200708-05.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477 · Security Note