PT-2017-17020 · Gd Library+2 · Libgd2+2

Varsleak · Published 2017-09-01 · Updated 2024-06-15 · CVE-2017-6362

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libgd2 versions prior to 2.2.5

Description The issue is related to a double free vulnerability in the gdImagePngPtr function. This vulnerability can be exploited by remote attackers to cause a denial of service, specifically through vectors related to a palette with no colors.

Recommendations For versions prior to 2.2.5, update to version 2.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the gdImagePngPtr function until a patch is available.

Fix

DoS

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2017-6362

DLA-1106-1

DSA-3961-1

MGASA-2017-0351

MGASA-2017-0356

OPENSUSE-SU-2024:10777-1

SUSE-SU-2018:0135-1

SUSE-SU-2018_0135-1

USN-3410-1

USN-3410-2

Affected Products

Suse

Ubuntu

Libgd2

References · 47

• https://github.com/libgd/libgd/releases/tag/gd-2.2.5 · Patch
• https://ubuntu.com/security/notices/USN-3410-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6362 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10777-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/OKUOTJ5FTMWQN74T3VDU57PWIVHXIOY2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/N2BLXX7KNRE7ZVQAKGTHHWS33CUCXVUP · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-6362 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0135-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-3961 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6362 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0351 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0356.html · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0356 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3410-1 · Vendor Advisory