PT-2021-7338 · Unknown+4 · Gd Graphics Library+4

Meweez · Published 2021-05-26 · Updated 2025-12-16 · CVE-2021-40145

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GD Graphics Library (aka LibGD) versions through 2.3.2

Description The issue is related to a double free in the gdImageGd2Ptr function in the gd gd2.c component of the GD Graphics Library. This can be exploited by a remote attacker to cause a denial of service. The vendor notes that the GD2 image format is proprietary and should be considered obsolete, only used for development and testing purposes.

Recommendations For versions through 2.3.2, consider updating to a version where this issue is fixed, if available. As a temporary workaround, restrict the use of the gdImageGd2Ptr function in gd gd2.c to minimize the risk of exploitation. However, since the specific fix version is not provided, and given the vendor's stance on the GD2 image format, it is essential to follow best practices for secure development and testing. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

AZL-6432

BDU:2022-05715

CVE-2021-40145

DLA-4411-1

MGASA-2021-0433

OESA-2022-1613

USN-5068-1

Affected Products

Astra Linux

Debian

Gd Graphics Library

Linuxmint

Ubuntu

References · 30

• 🔥 https://github.com/libgd/libgd/issues/700 · Exploit
• https://github.com/libgd/libgd/commit/c5fd25ce0e48fd5618a972ca9f5e28d6d62006af · Patch
• https://ubuntu.com/security/CVE-2017-6363 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0433.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6432 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-40145 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-40145 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-40145 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2021-40145 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38115 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40145 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5068-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1613 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory