Critical Vulnerability in GD Package: Uninitialized Memory Exposure in GIF Decoding
Summary
ALPINE-CVE-2017-7890: The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. Affects gd versions < 2.2.5-r0. Fixed in 2.2.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GD Graphics Library, commonly referred to as libgd, is a widely used open-source code library for the dynamic creation of images by programmers. It supports various image formats, including GIF, JPEG, and PNG, and is often utilized in web applications for image processing tasks. However, a significant vulnerability has been identified in the GIF decoding function, which can lead to the exposure of sensitive information due to uninitialized memory usage.
Vulnerability Detail
The vulnerability arises from the gdImageCreateFromGifCtx function in gd_gif_in.c, where the colorMap arrays are not zeroed before use. This oversight allows a specially crafted GIF image to exploit the uninitialized tables, potentially disclosing approximately 700 bytes of sensitive information from the stack. This issue affects PHP versions prior to 5.6.31 and 7.x versions before 7.1.7, making it critical for applications relying on these versions of PHP and the GD library.
How To Fix
Minimum fixed version
2.2.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade gdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted GIF images until the package is updated. Implement strict validation on image uploads to ensure that only safe and trusted images are processed.
Conclusion
The vulnerability in the GD package poses a significant risk due to the potential exposure of sensitive information through uninitialized memory. It is crucial for developers and system administrators to update their GD library to the patched version and ensure their PHP installations are secure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your applications.
See every vulnerability recorded for gd →
FAQ
The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
PHP versions prior to 5.6.31 and 7.x versions before 7.1.7 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to the disclosure of sensitive information, which may include user data or application secrets.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for gd.
