PT-2018-3816 · Php+7 · Libgd+7

Fabio Cabral Pacheco + 1 · Published 2018-07-12 · Updated 2024-06-15 · CVE-2018-14553

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libgd versions 2.1.0-rc2 through 2.2.5

Description The issue is related to a NULL pointer dereference in the gdImageClone function of the libgd library, specifically in the gd.c component. This allows a remote attacker to cause a denial of service by crashing an application through a specific sequence of function calls. It is noted that this only affects PHP when it is linked with an external libgd library, not when libgd is bundled with PHP.

Recommendations For libgd versions 2.1.0-rc2 through 2.2.5, consider updating to a version where this issue is fixed, as the current version allows attackers to crash applications via specific function calls. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2020:4659

BDU:2022-05698

CESA-2020_4659

CVE-2018-14553

DLA-2106-1

DLA-3781-1

MGASA-2020-0098

OPENSUSE-SU-2020:0332-1

OPENSUSE-SU-2020_0332-1

OPENSUSE-SU-2024:10777-1

RHSA-2020:4659

RHSA-2020_4659

RLSA-2020:4659

SUSE-SU-2020:0594-1

SUSE-SU-2020:0594-2

SUSE-SU-2020:0623-1

SUSE-SU-2020_0594-1

SUSE-SU-2020_0594-2

USN-4316-1

USN-4316-2

Affected Products

Almalinux

Astra Linux

Centos

Red Hat

Rocky Linux

Suse

Ubuntu

Libgd

References · 71

• https://github.com/libgd/libgd/commit/a93eac0e843148dc2d631c3ba80af17e9c8c860f · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14553 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-14553 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05698 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14553 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-14553 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0623-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0594-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14553 · Vendor Advisory
• https://usn.ubuntu.com/4316-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14553 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:0594-2 · Vendor Advisory