PT-2017-4205 · Gd+3 · Gd Graphics Library+3

Varsleak · Published 2017-02-17 · Updated 2024-08-05 · CVE-2017-6363

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions GD Graphics Library versions through 2.2.5

Description The issue is related to a heap-based buffer over-read in the tiffWriter function in gd tiff.c. This can allow a remote attacker to access confidential data and cause a denial of service using a specially crafted file in GD or GD2 formats. The vendor notes that the GD and GD2 formats are documented as obsolete and should only be used for development and testing purposes.

Recommendations For versions through 2.2.5, consider disabling the tiffWriter function in gd tiff.c as a temporary workaround to minimize the risk of exploitation. Restrict access to files in GD and GD2 formats to prevent potential attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-05697

CVE-2017-6363

USN-5068-1

Affected Products

Astra Linux

Gd Graphics Library

Linuxmint

Ubuntu

References · 22

• 🔥 https://github.com/libgd/libgd/issues/383 · Exploit
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-6363 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6363 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6363 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6363 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40145 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5068-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-6363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6363 · Security Note
• https://ubuntu.com/security/CVE-2021-38115 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-6363 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05697 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6363 · Vendor Advisory