CVE-2018-14553 — NULL Pointer Dereference in Libgd

CWE-476 — NULL Pointer DereferenceCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer12 documents8 sources
Severity
7.5HIGHNVD
EPSS
1.0%
top 23.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
LibgdCanonical Ubuntu LinuxDebian Linux+2 more
Timeline
PublishedFeb 11
Latest updateMay 24

Description

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDlibgd/libgd2.1.1 — 2.2.5+1
▶NVDopensuse/leap15.1

Also affects: Debian Linux 8.0, Fedora 32, Ubuntu Linux 14.04, 16.04, 18.04, 19.10

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-jw3x-9g83-4hvr: gdImageClone in gd↗2022-05-24
▶
OSV
libgd2 vulnerabilities↗2020-04-02
▶
OSV
libgd2 vulnerabilities↗2020-04-02
▶
CVEList
CVE-2018-14553: gdImageClone in gd↗2020-02-11
▶
OSV
CVE-2018-14553: gdImageClone in gd↗2020-02-11
▶

📋Vendor Advisories

4
Ubuntu
GD Graphics Library vulnerabilities↗2020-04-02
▶
Ubuntu
GD Graphics Library vulnerabilities↗2020-04-02
▶
Red Hat
gd: NULL pointer dereference in gdImageClone↗2019-12-20
▶
Debian
CVE-2018-14553: libgd2 - gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer derefer...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-14553 gd: Null pointer dereference in gdImageClone [fedora-all]↗2020-02-12
▶
Bugzilla
CVE-2018-14553 gd: NULL pointer dereference in gdImageClone↗2018-07-12
▶