PT-2019-1692 · Gd+6 · Gd Graphics Library+6

Simon Scannell · Published 2019-01-15 · Updated 2024-06-15 · CVE-2019-6978

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions The GD Graphics Library version 2.2.5

Description The issue is related to a double free error in the gdImage*Ptr() functions within the files gd gif out.c, gd jpeg.c, and gd wbmp.c of the graphic library. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For version 2.2.5, consider updating to a newer version that addresses the double free error in the gdImage*Ptr() functions to prevent potential exploitation. As a temporary workaround, consider restricting the use of the gdImage*Ptr() functions in gd gif out.c, gd jpeg.c, and gd wbmp.c until a patch is available.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALSA-2019:2722

ALSA-2020:4659

BDU:2019-01286

CESA-2019_2722

CESA-2020_3943

CESA-2020_4659

CVE-2019-6978

DLA-1651-1

DSA-4384-1

MGASA-2019-0073

MGASA-2019-0085

OPENSUSE-SU-2019:1148-1

OPENSUSE-SU-2019_0207-1

OPENSUSE-SU-2019_1140-1

OPENSUSE-SU-2019_1148-1

OPENSUSE-SU-2022_1516-1

OPENSUSE-SU-2024:10777-1

OPENSUSE-SU-2024:11012-1

RHSA-2019:2722

RHSA-2019_2722

RHSA-2020:3943

RHSA-2020:4659

RHSA-2020_3943

RHSA-2020_4659

RLSA-2019:2722

RLSA-2020:4659

SUSE-SU-2019:0333-1

SUSE-SU-2019:0747-1

SUSE-SU-2019:0771-1

SUSE-SU-2019:13961-1

SUSE-SU-2022:1516-1

SUSE-SU-2022:1560-1

SUSE-SU-2022_1516-1

SUSE-SU-2022_1560-1

USN-3900-1

Affected Products

Almalinux

Centos

Gd Graphics Library

Red Hat

Rocky Linux

Suse

Ubuntu

References · 90

• https://github.com/php/php-src/commit/089f7c0bc28d399b0420aa6ef058e4c1c120b2ae · Patch
• https://github.com/libgd/libgd/commit/553702980ae89c83f2d6e254d62cf82e204956d0 · Patch
• https://github.com/libgd/libgd/issues/492 · Patch
• https://osv.dev/vulnerability/MGASA-2019-0073 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-6978 · Security Note
• https://security.gentoo.org/glsa/201903-18 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6978 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0747-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:13961-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2019:2722 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6978 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEYUUOW75YD3DENIPYMO263E6NL2NFHI · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-6978 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0085.html · Security Note