Security Update for libgd2
Summary
DLA-3781-1: libgd2 - security update. Affects libgd2 versions < 2.2.5-5.2+deb10u1. Fixed in 2.2.5-5.2+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgd2 is a library for dynamically manipulating images. It provides functions to create, modify, and save images in various formats. The library is commonly used in web applications and graphic processing software. However, a vulnerability has been discovered in libgd2 that could potentially allow attackers to execute arbitrary code or cause denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2018-14553, CVE-2021-38115, and CVE-2021-40812, affects libgd2 version 0 and is present in Debian 10. It allows attackers to exploit buffer overflow and integer overflow issues, leading to potential remote code execution or denial of service attacks. The vulnerability arises from improper input validation and handling of image data. Attackers can craft malicious images that trigger these vulnerabilities when processed by applications using libgd2.
How To Fix
Minimum fixed version
2.2.5-5.2+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libgd2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, as a general security measure, it is advisable to ensure that applications using libgd2 properly validate and sanitize user-supplied image data to mitigate the risk of exploitation.
Conclusion
libgd2 has been found to have a vulnerability that could potentially allow attackers to execute arbitrary code or cause denial of service attacks. It is crucial to update libgd2 to the latest version to address these vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libgd2 →
FAQ
libgd2 is a library for dynamically manipulating images, commonly used in web applications and graphic processing software.
The vulnerability could allow attackers to execute arbitrary code or cause denial of service attacks.
The vulnerability affects libgd2 version 0 in Debian 10.
To fix the vulnerability, update libgd2 to version 2.2.5-5.2+deb10u1 or later.
There is no specific workaround, but ensuring proper validation and sanitization of user-supplied image data can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for libgd2.
