Moderate: gd security update
Summary
ALSA-2020:4659: Moderate: gd security update. Affects gd versions < 2.2.5-7.el8. Fixed in 2.2.5-7.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GD is an open source code library for the dynamic creation of images by programmers. It provides functionality for creating images in various formats such as PNG, JPEG, GIF, WebP, XPM, and BMP. The library is widely used in web development and other applications that involve image manipulation.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the gd library:
- CVE-2019-6977: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by providing a specially crafted image file.
- CVE-2018-14553: NULL pointer dereference in gdImageClone
This vulnerability could lead to a crash or potential code execution if a NULL pointer is dereferenced during the cloning of an image.
- CVE-2019-6978: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c
This vulnerability could be exploited to execute arbitrary code or cause a denial of service by providing a specially crafted image file that triggers a double free condition.
These vulnerabilities have a moderate impact and can be exploited remotely without authentication.
How To Fix
Minimum fixed version
2.2.5-7.el8
This is the first release that contains the fix.
sudo dnf update gdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the gd library is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause a denial of service. It is recommended to update the gd package to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gd →
FAQ
GD is an open source code library for the dynamic creation of images by programmers. It is commonly used in web development and other applications that involve image manipulation.
These vulnerabilities can allow an attacker to execute arbitrary code or cause a denial of service by providing a specially crafted image file.
Yes, these vulnerabilities can be exploited remotely without authentication.
No, there is no known workaround for these vulnerabilities. It is recommended to update the gd package to the latest version.
To update the gd package, you can use the package manager update command specific to your operating system. For AlmaLinux 8, you can use the command 'sudo dnf update gd'.
Related vulnerabilities
Recent vulnerabilities recorded for gd.
