PT-2021-7364 · Libgd+4 · Libgd+4

Meweez · Published 2021-04-30 · Updated 2025-12-16 · CVE-2021-38115

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibGD versions through 2.3.2

Description The issue is related to the read header tga function in the gd tga.c component of the LibGD graphics library. It involves reading beyond the valid boundaries of a data buffer. This can be exploited by a remote attacker using a specially crafted TGA file to cause a denial of service due to an out-of-bounds read.

Recommendations For versions through 2.3.2, consider updating to a version that fixes this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-6431

BDU:2022-05785

CVE-2021-38115

DLA-3781-1

DLA-4411-1

MGASA-2021-0433

OESA-2021-1315

USN-5068-1

Affected Products

Astra Linux

Debian

Libgd

Linuxmint

Ubuntu

References · 32

• 🔥 https://github.com/libgd/libgd/issues/697 · Exploit
• https://github.com/libgd/libgd/pull/711/commits/8b111b2b4a4842179be66db68d84dda91a246032 · Patch
• https://osv.dev/vulnerability/AZL-6431 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-38115 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-38115 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-38115 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1315 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5068-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38115 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3781-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40145 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05785 · Security Note
• https://advisories.mageia.org/MGASA-2021-0433.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38115 · Vendor Advisory