Debian Libgd2 vulnerabilities

CVE-2018-14553 [HIGH] CVE-2018-14553: libgd2 - gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer derefer... gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled). Scope: local bookworm: resolved (fixed in 2.3.0-1) bullseye: resolved (fixed in 2.3.0-1) forky: resolved (fixed in 2.3.0-1) sid: resolv

CVE-2017-6362 [HIGH] CVE-2017-6362: libgd2 - Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 a... Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors. Scope: local bookworm: resolved (fixed in 2.2.5-1) bullseye: resolved (fixed in 2.2.5-1) forky: resolved (fixed in 2.2.5-1) sid: resolved (fixed in 2.2.5-1) trixie: resolved (fixed in 2.2.5-

CVE-2015-8877 [HIGH] CVE-2015-8877: libgd2 - The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Librar... The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function. Scope: local bookworm: reso

CVE-2016-10168 [HIGH] CVE-2016-10168: libgd2 - Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 ... Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image. Scope: local bookworm: resolved (fixed in 2.2.4-1) bullseye: resolved (fixed in 2.2.4-1) forky: resolved (fixed in 2.2.4-1) sid: resolved (fixed in 2.2.4-1) t

CVE-2013-7456 [HIGH] CVE-2013-7456: libgd2 - gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used ... gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function. Scope: local bookworm: resolved (fixed in 2

CVE-2021-40145 [HIGH] CVE-2021-40145: libgd2 - gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 h... gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes. Scope: local bookworm: resolved (fixed in 2.3.3-1) bullseye: resolved (fixe

CVE-2016-6128 [HIGH] CVE-2016-6128: libgd2 - The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka l... The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index. Scope: local bookworm: resolved (fixed in 2.2.2-29-g3c2b605-1) bullseye: resolved (fixed in 2.2.2-29-g3c2b605-1) forky: resolved (fixed in 2.

CVE-2017-6363 [HIGH] CVE-2017-6363: libgd2 - In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buff... In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.' Scope: local bookworm: resolved (fixed in 2.3.0-1) bull

CVE-2017-7890 [MEDIUM] CVE-2017-7890: libgd2 - The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graph... The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information. Scope: local b

CVE-2018-5711 [MEDIUM] CVE-2018-5711: libgd2 - gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33... gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCrea

CVE-2019-11038 [MEDIUM] CVE-2019-11038: libgd2 - When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka L... When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has be

CVE-2016-6207 [MEDIUM] CVE-2016-6207: libgd2 - Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in ... Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors. Scope: local bookworm: resolved (fixed in 2.2.2-43-g22cba39-1) bullseye: resolved (fixed in 2.2.2-43-g22cba39-1) fo

CVE-2014-9709 [MEDIUM] CVE-2014-9709: libgd2 - The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP bef... The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function. Scope: local bookworm: resolved (fixed in 2.1.0-5) bullseye: resolved (

CVE-2014-2497 [MEDIUM] CVE-2014-2497: libgd2 - The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and... The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file. Scope: local bookworm: resolved (fixed in 2.1.0-4) bullseye: resolved (fixed in 2.1.0-4) forky: resolved (fixed in 2.1.0-4) sid: resolv

CVE-2007-3996 [MEDIUM] CVE-2007-3996: libgd2 - Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers t... Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function. Scope:

CVE-2016-6132 [MEDIUM] CVE-2016-6132: libgd2 - The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) befo... The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. Scope: local bookworm: resolved (fixed in 2.2.2-29-g3c2b605-1) bullseye: resolved (fixed in 2.2.2-29-g3c2b605-1) forky: resolved (fixed in 2.2.2-29-g3c2b605-1) sid: resolved (fixed i

CVE-2016-6214 [MEDIUM] CVE-2016-6214: libgd2 - gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attac... gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. Scope: local bookworm: resolved (fixed in 2.2.2-29-g3c2b605-1) bullseye: resolved (fixed in 2.2.2-29-g3c2b605-1) forky: resolved (fixed in 2.2.2-29-g3c2b605-1) sid: resolved (fixed in 2.2.2-29-g3c2b605-1) trixi

CVE-2021-38115 [MEDIUM] CVE-2021-38115: libgd2 - read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2... read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file. Scope: local bookworm: resolved (fixed in 2.3.3-1) bullseye: resolved (fixed in 2.3.0-2+deb11u1) forky: resolved (fixed in 2.3.3-1) sid: resolved (fixed in 2.3.3-1) trixie: resolved (fixed

CVE-2021-40812 [MEDIUM] CVE-2021-40812: libgd2 - The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read beca... The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks. Scope: local bookworm: resolved (fixed in 2.3.3-1) bullseye: resolved (fixed in 2.3.0-2+deb11u1) forky: resolved (fixed in 2.3.3-1) sid: resolved (fixed in 2.3.3-1) trixie: resolved (fixed in 2.3.3-1)

CVE-2016-6905 [MEDIUM] CVE-2016-6905: libgd2 - The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) b... The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image. Scope: local bookworm: resolved (fixed in 2.2.2-29-g3c2b605-1) bullseye: resolved (fixed in 2.2.2-29-g3c2b605-1) forky: resolved (fixed in 2.2.2-29-g3c2b605-1) sid: resolved (fix