Critical Double Free Vulnerability in GD Package - CVE-2017-6362
Summary
ALPINE-CVE-2017-6362: Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors. Affects gd versions < 2.2.5-r0. Fixed in 2.2.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GD package is a widely used library for the dynamic creation of images in various formats, including PNG, JPEG, and GIF. It provides essential functionalities for image processing and manipulation, making it a critical component in many web applications. However, the GD library has been found to have a double free vulnerability that can lead to denial of service attacks, particularly affecting versions prior to 2.2.5.
Vulnerability Detail
The vulnerability, identified as CVE-2017-6362, originates from a flaw in the gdImagePngPtr function within libgd2 versions before 2.2.5. This double free issue allows remote attackers to exploit the library by sending specially crafted images that contain a palette with no colors. The result can lead to a denial of service, causing the application to crash or become unresponsive. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.2.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade gdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to filter out potentially malicious image files. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
CVE-2017-6362 is a critical vulnerability in the GD package that can lead to denial of service attacks. It is crucial to update to the patched version 2.2.5-r0 to mitigate the risk. Additionally, using tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for gd →
FAQ
CVE-2017-6362 is a double free vulnerability in the GD library that can lead to denial of service attacks.
Versions of the GD package prior to 2.2.5 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2017-6362 is 7.5, indicating a high severity level.
If you cannot update the GD package immediately, implement input validation to filter out potentially harmful image files as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for gd.
